\n'
)]
for tid in conns.tunnels:
proto, domain = tid.split(':')
if '-' in proto: proto, port = proto.split('-')
if tid in backends:
backend = backends[tid][BE_BACKEND]
if proto.startswith('http'):
binfo = '%s' % (proto, backend, backend)
else:
binfo = '%s' % backend
else:
binfo = 'none'
if proto.startswith('http'):
tinfo = '%s: %s' % (proto, proto, domain, domain)
else:
tinfo = '%s: %s' % (proto, domain)
for tunnel in conns.tunnels[tid]:
html.append(('
%s'
' (%s to'
' %s,'
' %s in, %s out)'
'
\n') % (tinfo,
tunnel.server_info[tunnel.S_NAME].split(':')[0],
binfo,
fmt_size(tunnel.all_in + tunnel.read_bytes),
fmt_size(tunnel.all_out + tunnel.wrote_bytes)))
if not conns.tunnels:
html.append('None')
html.append(
'
\n'
)
return {
'title': 'Control Panel',
'body': ''.join(html)
}
def txt_log(self):
return '\n'.join(['%s' % x for x in LOG])
def html_log(self, path):
debug = path.find('debug') >= 0
httpd = path.find('httpd') >= 0
alllog = path.find('all') >= 0
html = ['
']
lines = []
for line in LOG:
if not alllog and ('debug' in line) != debug: continue
if not alllog and ('uireq' in line) != httpd: continue
keys = line.keys()
keys.sort()
lhtml = ('
%s
'
'
' % time.strftime('%Y-%m-%d %H:%M:%S',
time.localtime(int(line['ts'], 16))))
for key in keys:
if key != 'ts':
lhtml += ('
']
sids = SELECTABLES.keys()
sids.sort(reverse=True)
for sid in sids:
sel = SELECTABLES[sid]
html.append('
%s%s'
' ' % (sid, escape_html(str(sel)),
sel.dead and ' ' or ' alive'))
html.append('
')
return {
'title': 'Connection log',
'body': ''.join(html)
}
def html_conn(self, path):
sid = int(path[len('/conn/'):])
if sid in SELECTABLES:
html = ['
%s
' % escape_html('%s' % SELECTABLES[sid]),
SELECTABLES[sid].__html__()]
else:
html = ['
Connection %s not found. Expired?
' % sid]
return {
'title': 'Connection details',
'body': ''.join(html)
}
def begin_headers(self, code, mimetype):
self.send_response(code)
self.send_header('Cache-Control', 'no-store')
self.send_header('Pragma', 'no-cache')
self.send_header('Content-Type', mimetype)
def do_GET(self):
(scheme, netloc, path, params, query, frag) = urlparse(self.path)
data = {
'prog': (sys.argv[0] or 'pagekite.py').split('/')[-1],
'now': time.strftime('%Y-%m-%d %H:%M:%S', time.localtime()),
'ver': APPVER
}
authenticated = False
if self.server.pkite.ui_password:
auth = self.headers.get('authorization')
if auth:
(how, ab64) = auth.split()
if how.lower() == 'basic':
(uid, password) = base64.b64decode(ab64).split(':')
authenticated = (password == self.server.pkite.ui_password)
elif query.find('auth=%s' % self.server.pkite.ui_password) != -1:
authenticated = True
if not authenticated:
self.begin_headers(401, 'text/html')
self.send_header('WWW-Authenticate',
'Basic realm=PK%d' % (time.time()/3600))
self.end_headers()
data['title'] = data['body'] = 'Authentication required.'
self.wfile.write(self.TEMPLATE_HTML % data)
return
if path.endswith('.txt'):
template = self.TEMPLATE_TEXT
self.begin_headers(200, 'text/plain')
else:
template = self.TEMPLATE_HTML
self.begin_headers(200, 'text/html')
self.end_headers()
qs = parse_qs(query)
if path == '/vars.txt':
global gYamon
data['body'] = gYamon.render_vars_text()
elif path == '/log.txt': data['body'] = self.txt_log()
elif path.endswith('log.html'): data.update(self.html_log(path))
elif path == '/conns/': data.update(self.html_conns())
elif path.startswith('/conn/'): data.update(self.html_conn(path))
else: data.update(self.html_overview())
self.wfile.write(template % data)
class UiHttpServer(SimpleXMLRPCServer):
def __init__(self, sspec, pkite, conns,
handler=UiRequestHandler,
ssl_pem_filename=None):
SimpleXMLRPCServer.__init__(self, sspec, handler)
self.pkite = pkite
self.conns = conns
# FIXME: There should be access control on these
#self.register_introspection_functions()
#self.register_instance(conns)
if ssl_pem_filename:
ctx = SSL.Context(SSL.SSLv23_METHOD)
ctx.use_privatekey_file (ssl_pem_filename)
ctx.use_certificate_chain_file(ssl_pem_filename)
self.socket = SSL_Connect(ctx, socket.socket(self.address_family,
self.socket_type),
server_side=True)
self.server_bind()
self.server_activate()
self.enable_ssl = True
else:
self.enable_ssl = False
global gYamon
gYamon = YamonD(sspec)
gYamon.vset('started', int(time.time()))
gYamon.vset('version', APPVER)
gYamon.vset('httpd_ssl_enabled', self.enable_ssl)
gYamon.vset('errors', 0)
gYamon.vset("bytes_all", 0)
class HttpUiThread(threading.Thread):
"""Handle HTTP UI in a separate thread."""
def __init__(self, pkite, conns,
server=UiHttpServer, handler=UiRequestHandler,
ssl_pem_filename=None):
threading.Thread.__init__(self)
self.ui_sspec = pkite.ui_sspec
self.httpd = server(self.ui_sspec, pkite, conns,
handler=handler,
ssl_pem_filename=ssl_pem_filename)
self.httpd.socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
self.serve = True
global SELECTABLES
SELECTABLES = {}
def quit(self):
self.serve = False
try:
knock = rawsocket(socket.AF_INET, socket.SOCK_STREAM)
knock.connect(self.ui_sspec)
knock.close()
except Exception:
pass
def run(self):
while self.serve:
try:
self.httpd.handle_request()
except KeyboardInterrupt:
self.serve = False
except Exception, e:
LogInfo('HTTP UI caught exception: %s' % e)
LogDebug('HttpUiThread: done')
self.httpd.socket.close()
HTTP_METHODS = ['OPTIONS', 'CONNECT', 'GET', 'HEAD', 'POST', 'PUT', 'TRACE',
'PROPFIND', 'PROPPATCH', 'MKCOL', 'DELETE', 'COPY', 'MOVE',
'LOCK', 'UNLOCK', 'PING']
HTTP_VERSIONS = ['HTTP/1.0', 'HTTP/1.1']
class HttpParser(object):
"""Parse an HTTP request, line-by-line."""
IN_REQUEST = 1
IN_HEADERS = 2
IN_BODY = 3
IN_RESPONSE = 4
PARSE_FAILED = -1
def __init__(self, lines=None, state=None, testbody=False):
self.state = state or self.IN_REQUEST
self.method = None
self.path = None
self.version = None
self.code = None
self.message = None
self.headers = []
self.lines = []
self.body_result = testbody
if lines is not None:
for line in lines:
if not self.Parse(line): break
def ParseResponse(self, line):
self.version, self.code, self.message = line.split()
if not self.version.upper() in HTTP_VERSIONS:
LogDebug('Invalid version: %s' % self.version)
return False
self.state = self.IN_HEADERS
return True
def ParseRequest(self, line):
self.method, self.path, self.version = line.split()
if not self.method in HTTP_METHODS:
LogDebug('Invalid method: %s' % self.method)
return False
if not self.version.upper() in HTTP_VERSIONS:
LogDebug('Invalid version: %s' % self.version)
return False
self.state = self.IN_HEADERS
return True
def ParseHeader(self, line):
if line in ('', '\r', '\n', '\r\n'):
self.state = self.IN_BODY
return True
header, value = line.split(':', 1)
if value and value.startswith(' '): value = value[1:]
self.headers.append((header.lower(), value))
return True
def ParseBody(self, line):
# Could be overridden by subclasses, for now we just play dumb.
return self.body_result
def Parse(self, line):
self.lines.append(line)
try:
if (self.state == self.IN_RESPONSE):
return self.ParseResponse(line)
elif (self.state == self.IN_REQUEST):
return self.ParseRequest(line)
elif (self.state == self.IN_HEADERS):
return self.ParseHeader(line)
elif (self.state == self.IN_BODY):
return self.ParseBody(line)
except ValueError, err:
LogInfo('Parse failed: %s, %s, %s' % (self.state, err, self.lines))
self.state = self.PARSE_FAILED
return False
def Header(self, header):
return [h[1].strip() for h in self.headers if h[0] == header.lower()]
def obfuIp(ip):
quads = ('%s' % ip).replace(':', '.').split('.')
return '~%s' % '.'.join([q for q in quads[-2:]])
selectable_id = 0
buffered_bytes = 0
SELECTABLES = None
class Selectable(object):
"""A wrapper around a socket, for use with select."""
HARMLESS_ERRNOS = (errno.EINTR, errno.EAGAIN, errno.ENOMEM, errno.EBUSY,
errno.EDEADLK, errno.EWOULDBLOCK, errno.ENOBUFS,
errno.EALREADY)
def __init__(self, fd=None, address=None, on_port=None, maxread=16000,
tracked=True):
self.fd = None
try:
self.SetFD(fd or rawsocket(socket.AF_INET6, socket.SOCK_STREAM), six=True)
except Exception:
self.SetFD(fd or rawsocket(socket.AF_INET, socket.SOCK_STREAM))
self.address = address
self.on_port = on_port
self.created = self.bytes_logged = time.time()
self.dead = False
# Quota-related stuff
self.quota = None
# Read-related variables
self.maxread = maxread
self.read_bytes = self.all_in = 0
self.read_eof = False
self.peeking = False
self.peeked = 0
# Write-related variables
self.wrote_bytes = self.all_out = 0
self.write_blocked = ''
self.write_speed = 102400
self.write_eof = False
self.write_retry = None
# Throttle reads and writes
self.throttle_until = 0
# Compression stuff
self.zw = None
self.zlevel = 1
self.zreset = False
# Logging
self.logged = []
global selectable_id
selectable_id += 1
self.sid = selectable_id
self.alt_id = None
if address:
addr = address or ('x.x.x.x', 'x')
self.log_id = 's%s/%s:%s' % (self.sid, obfuIp(addr[0]), addr[1])
else:
self.log_id = 's%s' % self.sid
# Introspection
if SELECTABLES is not None:
old = selectable_id-150
if old in SELECTABLES: del SELECTABLES[old]
if tracked: SELECTABLES[selectable_id] = self
global gYamon
self.countas = 'selectables_live'
gYamon.vadd(self.countas, 1)
gYamon.vadd('selectables', 1)
def CountAs(self, what):
global gYamon
gYamon.vadd(self.countas, -1)
self.countas = what
gYamon.vadd(self.countas, 1)
def __del__(self):
global gYamon
gYamon.vadd(self.countas, -1)
gYamon.vadd('selectables', -1)
def __str__(self):
return '%s: %s' % (self.log_id, self.__class__)
def __html__(self):
try:
peer = self.fd.getpeername()
sock = self.fd.getsockname()
except Exception:
peer = ('x.x.x.x', 'x')
sock = ('x.x.x.x', 'x')
return ('Outgoing ZChunks: %s '
'Buffered bytes: %s '
'Remote address: %s '
'Local address: %s '
'Bytes in / out: %s / %s '
'Created: %s '
'Status: %s '
' '
'Logged:
%s
'
'\n') % (self.zw and ('level %d' % self.zlevel) or 'off',
len(self.write_blocked),
self.dead and '-' or (obfuIp(peer[0]), peer[1]),
self.dead and '-' or (obfuIp(sock[0]), sock[1]),
fmt_size(self.all_in + self.read_bytes),
fmt_size(self.all_out + self.wrote_bytes),
time.strftime('%Y-%m-%d %H:%M:%S',
time.localtime(self.created)),
self.dead and 'dead' or 'alive',
''.join(['
%s' % (l, ) for l in self.logged]))
def ResetZChunks(self):
if self.zw:
self.zreset = True
self.zw = zlib.compressobj(self.zlevel)
def EnableZChunks(self, level=1):
self.zlevel = level
self.zw = zlib.compressobj(level)
def SetFD(self, fd, six=False):
if self.fd:
self.fd.close()
self.fd = fd
self.fd.setblocking(0)
try:
if six: self.fd.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0)
self.fd.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)
self.fd.setsockopt(socket.SOL_TCP, socket.TCP_KEEPIDLE, 60)
self.fd.setsockopt(socket.SOL_TCP, socket.TCP_KEEPCNT, 10)
self.fd.setsockopt(socket.SOL_TCP, socket.TCP_KEEPINTVL, 1)
except Exception:
pass
def SetConn(self, conn):
self.SetFD(conn.fd)
self.log_id = conn.log_id
self.read_bytes = conn.read_bytes
self.wrote_bytes = conn.wrote_bytes
def Log(self, values):
if self.log_id: values.append(('id', self.log_id))
Log(values)
self.logged.append(('', values))
def LogError(self, error, params=None):
values = params or []
if self.log_id: values.append(('id', self.log_id))
LogError(error, values)
self.logged.append((error, values))
def LogDebug(self, message, params=None):
values = params or []
if self.log_id: values.append(('id', self.log_id))
LogDebug(message, values)
self.logged.append((message, values))
def LogInfo(self, message, params=None):
values = params or []
if self.log_id: values.append(('id', self.log_id))
LogInfo(message, values)
self.logged.append((message, values))
def LogTraffic(self, final=False):
if self.wrote_bytes or self.read_bytes:
now = time.time()
self.all_out += self.wrote_bytes
self.all_in += self.read_bytes
global gYamon
gYamon.vadd("bytes_all", self.wrote_bytes
+ self.read_bytes, wrap=1000000000)
if final:
self.Log([('wrote', '%d' % self.wrote_bytes),
('wbps', '%d' % self.write_speed),
('read', '%d' % self.read_bytes),
('eof', '1')])
else:
self.Log([('wrote', '%d' % self.wrote_bytes),
('wbps', '%d' % self.write_speed),
('read', '%d' % self.read_bytes)])
self.bytes_logged = now
self.wrote_bytes = self.read_bytes = 0
elif final:
self.Log([('eof', '1')])
def Cleanup(self, close=True):
global buffered_bytes
buffered_bytes -= len(self.write_blocked)
self.write_blocked = self.peeked = self.zw = ''
if not self.dead:
self.dead = True
self.CountAs('selectables_dead')
if close:
if self.fd:
self.fd.close()
self.fd = None
self.LogTraffic(final=True)
def ProcessData(self, data):
self.LogError('Selectable::ProcessData: Should be overridden!')
return False
def ProcessEof(self):
if self.read_eof and self.write_eof and not self.write_blocked:
self.Cleanup()
return False
return True
def ProcessEofRead(self):
self.read_eof = True
self.LogError('Selectable::ProcessEofRead: Should be overridden!')
return False
def ProcessEofWrite(self):
self.write_eof = True
self.LogError('Selectable::ProcessEofWrite: Should be overridden!')
return False
def EatPeeked(self, eat_bytes=None, keep_peeking=False):
if not self.peeking: return
if eat_bytes is None: eat_bytes = self.peeked
discard = ''
while len(discard) < eat_bytes:
try:
discard += self.fd.recv(eat_bytes - len(discard))
except socket.error, (errno, msg):
self.LogInfo('Error reading (%d/%d) socket: %s (errno=%s)' % (
eat_bytes, self.peeked, msg, errno))
time.sleep(0.1)
self.peeked -= eat_bytes
self.peeking = keep_peeking
return
def ReadData(self, maxread=None):
if self.read_eof:
return False
try:
maxread = maxread or self.maxread
if self.peeking:
data = self.fd.recv(maxread, socket.MSG_PEEK)
self.peeked = len(data)
if DEBUG_IO: print '<== IN (peeked)\n%s\n===' % data
else:
data = self.fd.recv(maxread)
if DEBUG_IO: print '<== IN\n%s\n===' % data
except (SSL.WantReadError, SSL.WantWriteError), err:
return True
except IOError, err:
if err.errno not in self.HARMLESS_ERRNOS:
self.LogDebug('Error reading socket: %s (%s)' % (err, err.errno))
return False
else:
return True
except (SSL.Error, SSL.ZeroReturnError, SSL.SysCallError), err:
self.LogDebug('Error reading socket (SSL): %s' % err)
return False
except socket.error, (errno, msg):
if errno in self.HARMLESS_ERRNOS:
return True
else:
self.LogInfo('Error reading socket: %s (errno=%s)' % (msg, errno))
return False
if data is None or data == '':
self.read_eof = True
return self.ProcessData('')
else:
if not self.peeking:
self.read_bytes += len(data)
if self.read_bytes > LOG_THRESHOLD: self.LogTraffic()
return self.ProcessData(data)
def Throttle(self, max_speed=None, remote=False, delay=0.2):
if max_speed:
self.throttle_until = time.time()
flooded = self.read_bytes + self.all_in
flooded -= max_speed * (time.time() - self.created)
delay = min(15, max(0.2, flooded/max_speed))
if flooded < 0: delay = 15
else:
if self.throttle_until < time.time(): self.throttle_until = time.time()
flooded = '?'
self.throttle_until += delay
self.LogInfo('Throttled until %x (flooded=%s, bps=%s, remote=%s)' % (
int(self.throttle_until), flooded, max_speed, remote))
return True
def Send(self, data, try_flush=False):
global buffered_bytes
buffered_bytes -= len(self.write_blocked)
# If we're already blocked, just buffer unless explicitly asked to flush.
if (not try_flush) and (len(self.write_blocked) > 0 or SEND_ALWAYS_BUFFERS):
self.write_blocked += ''.join(data)
buffered_bytes += len(self.write_blocked)
return True
self.write_speed = int((self.wrote_bytes + self.all_out) / (0.1 + time.time() - self.created))
sending = self.write_blocked+(''.join(data))
self.write_blocked = ''
sent_bytes = 0
if sending:
try:
sent_bytes = self.fd.send(sending[:(self.write_retry or SEND_MAX_BYTES)])
if DEBUG_IO: print '==> OUT\n%s\n===' % sending[:sent_bytes]
self.wrote_bytes += sent_bytes
self.write_retry = None
except IOError, err:
if err.errno not in self.HARMLESS_ERRNOS:
self.LogInfo('Error sending: %s' % err)
self.ProcessEofWrite()
return False
else:
self.write_retry = len(sending)
except (SSL.WantWriteError, SSL.WantReadError), err:
self.write_retry = len(sending)
except socket.error, (errno, msg):
if errno not in self.HARMLESS_ERRNOS:
self.LogInfo('Error sending: %s (errno=%s)' % (msg, errno))
self.ProcessEofWrite()
return False
else:
self.write_retry = len(sending)
except (SSL.Error, SSL.ZeroReturnError, SSL.SysCallError), err:
self.LogInfo('Error sending (SSL): %s' % err)
self.ProcessEofWrite()
return False
self.write_blocked = sending[sent_bytes:]
buffered_bytes += len(self.write_blocked)
if self.wrote_bytes >= LOG_THRESHOLD: self.LogTraffic()
if self.write_eof and not self.write_blocked: self.ProcessEofWrite()
return True
def SendChunked(self, data, compress=True, zhistory=None):
rst = ''
if self.zreset:
self.zreset = False
rst = 'R'
# Stop compressing streams that just get bigger.
if zhistory and (zhistory[0] < zhistory[1]): compress = False
sdata = ''.join(data)
if self.zw and compress:
try:
zdata = self.zw.compress(sdata) + self.zw.flush(zlib.Z_SYNC_FLUSH)
if zhistory:
zhistory[0] = len(sdata)
zhistory[1] = len(zdata)
return self.Send(['%xZ%x%s\r\n%s' % (len(sdata), len(zdata), rst, zdata)])
except zlib.error:
LogError('Error compressing, resetting ZChunks.')
self.ResetZChunks()
return self.Send(['%x%s\r\n%s' % (len(sdata), rst, sdata)])
def Flush(self, loops=50, wait=False):
while loops != 0 and len(self.write_blocked) > 0 and self.Send([],
try_flush=True):
if wait and len(self.write_blocked) > 0: time.sleep(0.1)
loops -= 1
if self.write_blocked: return False
return True
class Connections(object):
"""A container for connections (Selectables), config and tunnel info."""
def __init__(self, config):
self.config = config
self.ip_tracker = {}
self.conns = []
self.conns_by_id = {}
self.tunnels = {}
self.auth = None
def start(self, auth_thread=None):
self.auth = auth_thread or AuthThread(self)
self.auth.start()
def Add(self, conn, alt_id=None):
self.conns.append(conn)
if alt_id: self.conns_by_id[alt_id] = conn
def TrackIP(self, ip, domain):
tick = '%d' % (time.time()/12)
if tick not in self.ip_tracker:
deadline = int(tick)-10
for ot in self.ip_tracker.keys():
if int(ot) < deadline: del self.ip_tracker[ot]
self.ip_tracker[tick] = {}
if ip not in self.ip_tracker[tick]:
self.ip_tracker[tick][ip] = [1, domain]
else:
self.ip_tracker[tick][ip][0] += 1
self.ip_tracker[tick][ip][1] = domain
def LastIpDomain(self, ip):
domain = None
for tick in sorted(self.ip_tracker.keys()):
if ip in self.ip_tracker[tick]: domain = self.ip_tracker[tick][ip][1]
return domain
def Remove(self, conn):
if conn.alt_id and conn.alt_id in self.conns_by_id:
del self.conns_by_id[conn.alt_id]
if conn in self.conns:
self.conns.remove(conn)
for tid in self.tunnels.keys():
if conn in self.tunnels[tid]:
self.tunnels[tid].remove(conn)
if not self.tunnels[tid]: del self.tunnels[tid]
def Readable(self):
# FIXME: This is O(n)
now = time.time()
return [s.fd for s in self.conns if (s.fd
and (not s.read_eof)
and (s.throttle_until <= now))]
def Blocked(self):
# FIXME: This is O(n)
return [s.fd for s in self.conns if s.fd and len(s.write_blocked) > 0]
def DeadConns(self):
return [s for s in self.conns if s.read_eof and s.write_eof and not s.write_blocked]
def CleanFds(self):
evil = []
for s in self.conns:
try:
i, o, e = select.select([s.fd], [s.fd], [s.fd], 0)
except Exception:
evil.append(s)
for s in evil:
LogDebug('Removing broken Selectable: %s' % s)
self.Remove(s)
def Connection(self, fd):
for conn in self.conns:
if conn.fd == fd:
return conn
return None
def TunnelServers(self):
servers = {}
for tid in self.tunnels:
for tunnel in self.tunnels[tid]:
server = tunnel.server_info[tunnel.S_NAME]
if server is not None:
servers[server] = 1
return servers.keys()
def Tunnel(self, proto, domain, conn=None):
tid = '%s:%s' % (proto, domain)
if conn is not None:
if tid not in self.tunnels:
self.tunnels[tid] = []
self.tunnels[tid].append(conn)
if tid in self.tunnels:
return self.tunnels[tid]
else:
return []
class LineParser(Selectable):
"""A Selectable which parses the input as lines of text."""
def __init__(self, fd=None, address=None, on_port=None, tracked=True):
Selectable.__init__(self, fd, address, on_port, tracked=tracked)
self.leftovers = ''
def __html__(self):
return Selectable.__html__(self)
def Cleanup(self, close=True):
Selectable.Cleanup(self, close=close)
self.leftovers = ''
def ProcessData(self, data):
lines = (self.leftovers+data).splitlines(True)
self.leftovers = ''
while lines:
line = lines.pop(0)
if line.endswith('\n'):
if self.ProcessLine(line, lines) is False:
return False
else:
if not self.peeking: self.leftovers += line
if self.read_eof: return self.ProcessEofRead()
return True
def ProcessLine(self, line, lines):
self.LogError('LineParser::ProcessLine: Should be overridden!')
return False
TLS_CLIENTHELLO = '%c' % 026
SSL_CLIENTHELLO = '\x80'
# FIXME: XMPP support
class MagicProtocolParser(LineParser):
"""A Selectable which recognizes HTTP, TLS or XMPP preambles."""
def __init__(self, fd=None, address=None, on_port=None):
LineParser.__init__(self, fd, address, on_port, tracked=False)
self.leftovers = ''
self.might_be_tls = True
self.is_tls = False
def __html__(self):
return ('Detected TLS: %s '
'%s') % (self.is_tls,
LineParser.__html__(self))
# FIXME: DEPRECATE: Make this all go away, switch to CONNECT.
def ProcessMagic(self, data):
args = {}
try:
prefix, words, data = data.split('\r\n', 2)
for arg in words.split('; '):
key, val = arg.split('=', 1)
args[key] = val
self.EatPeeked(eat_bytes=len(prefix)+2+len(words)+2)
except ValueError, e:
return True
try:
port = 'port' in args and args['port'] or None
if port: self.on_port = int(port)
except ValueError, e:
return False
proto = 'proto' in args and args['proto'] or None
if proto in ('http', 'websocket'):
return LineParser.ProcessData(self, data)
domain = 'domain' in args and args['domain'] or None
if proto == 'https': return self.ProcessTls(data, domain)
if proto == 'raw' and domain: return self.ProcessRaw(data, domain)
return False
def ProcessData(self, data):
if data.startswith(MAGIC_PREFIX): return self.ProcessMagic(data)
if self.might_be_tls:
self.might_be_tls = False
if not data.startswith(TLS_CLIENTHELLO) and not data.startswith(SSL_CLIENTHELLO):
self.EatPeeked()
return LineParser.ProcessData(self, data)
self.is_tls = True
if self.is_tls:
return self.ProcessTls(data)
else:
self.EatPeeked()
return LineParser.ProcessData(self, data)
def GetMsg(self, data):
mtype, ml24, mlen = struct.unpack('>BBH', data[0:4])
mlen += ml24 * 0x10000
return mtype, data[4:4+mlen], data[4+mlen:]
def GetClientHelloExtensions(self, msg):
# Ugh, so many magic numbers! These are accumulated sizes of
# the different fields we are ignoring in the TLS headers.
slen = struct.unpack('>B', msg[34])[0]
cslen = struct.unpack('>H', msg[35+slen:37+slen])[0]
cmlen = struct.unpack('>B', msg[37+slen+cslen])[0]
extofs = 34+1+2+1+2+slen+cslen+cmlen
if extofs < len(msg): return msg[extofs:]
return None
def GetSniNames(self, extensions):
names = []
while extensions:
etype, elen = struct.unpack('>HH', extensions[0:4])
if etype == 0:
# OK, we found an SNI extension, get the list.
namelist = extensions[6:4+elen]
while namelist:
ntype, nlen = struct.unpack('>BH', namelist[0:3])
if ntype == 0: names.append(namelist[3:3+nlen].lower())
namelist = namelist[3+nlen:]
extensions = extensions[4+elen:]
return names
def GetSni(self, data):
hello, vmajor, vminor, mlen = struct.unpack('>BBBH', data[0:5])
data = data[5:]
sni = []
while data:
mtype, msg, data = self.GetMsg(data)
if mtype == 1:
# ClientHello!
sni.extend(self.GetSniNames(self.GetClientHelloExtensions(msg)))
return sni
def ProcessTls(self, data, domain=None):
self.LogError('TlsOrLineParser::ProcessTls: Should be overridden!')
return False
def ProcessRaw(self, data, domain):
self.LogError('TlsOrLineParser::ProcessRaw: Should be overridden!')
return False
class ChunkParser(Selectable):
"""A Selectable which parses the input as chunks."""
def __init__(self, fd=None, address=None, on_port=None):
Selectable.__init__(self, fd, address, on_port)
self.want_cbytes = 0
self.want_bytes = 0
self.compressed = False
self.header = ''
self.chunk = ''
self.zr = zlib.decompressobj()
def __html__(self):
return Selectable.__html__(self)
def Cleanup(self, close=True):
Selectable.Cleanup(self, close=close)
self.zr = self.chunk = self.header = None
def ProcessData(self, data):
if self.peeking:
self.want_cbytes = 0
self.want_bytes = 0
self.header = ''
self.chunk = ''
if self.want_bytes == 0:
self.header += data
if self.header.find('\r\n') < 0:
if self.read_eof: return self.ProcessEofRead()
return True
try:
size, data = self.header.split('\r\n', 1)
self.header = ''
if size.endswith('R'):
self.zr = zlib.decompressobj()
size = size[0:-1]
if 'Z' in size:
csize, zsize = size.split('Z')
self.compressed = True
self.want_cbytes = int(csize, 16)
self.want_bytes = int(zsize, 16)
else:
self.compressed = False
self.want_bytes = int(size, 16)
except ValueError, err:
self.LogError('ChunkParser::ProcessData: %s' % err)
self.Log([('bad_data', data)])
return False
if self.want_bytes == 0:
return False
process = data[:self.want_bytes]
leftover = data[self.want_bytes:]
self.chunk += process
self.want_bytes -= len(process)
result = 1
if self.want_bytes == 0:
if self.compressed:
try:
cchunk = self.zr.decompress(self.chunk)
except zlib.error:
cchunk = ''
if len(cchunk) != self.want_cbytes:
result = self.ProcessCorruptChunk(self.chunk)
else:
result = self.ProcessChunk(cchunk)
else:
result = self.ProcessChunk(self.chunk)
self.chunk = ''
if result and leftover:
result = self.ProcessData(leftover)
if self.read_eof: result = self.ProcessEofRead() and result
return result
def ProcessCorruptChunk(self, chunk):
self.LogError('ChunkParser::ProcessData: ProcessCorruptChunk not overridden!')
return False
def ProcessChunk(self, chunk):
self.LogError('ChunkParser::ProcessData: ProcessChunk not overridden!')
return False
class Tunnel(ChunkParser):
"""A Selectable representing a PageKite tunnel."""
S_NAME = 0
S_PORTS = 1
S_RAW_PORTS = 2
S_PROTOS = 3
def __init__(self, conns):
ChunkParser.__init__(self)
# We want to be sure to read the entire chunk at once, including
# headers to save cycles, so we double the size we're willing to
# read here.
self.maxread *= 2
self.server_info = ['x.x.x.x:x', [], [], []]
self.conns = conns
self.users = {}
self.remote_ssl = {}
self.zhistory = {}
self.backends = {}
self.rtt = 100000
self.last_activity = time.time()
self.last_ping = 0
def __html__(self):
return ('Server name: %s '
'%s') % (self.server_info[self.S_NAME], ChunkParser.__html__(self))
def _FrontEnd(conn, body, conns):
"""This is what the front-end does when a back-end requests a new tunnel."""
self = Tunnel(conns)
requests = []
try:
for prefix in ('X-Beanstalk', 'X-PageKite'):
for feature in conn.parser.Header(prefix+'-Features'):
if feature == 'ZChunks': self.EnableZChunks(level=1)
# Track which versions we see in the wild.
version = 'old'
for v in conn.parser.Header(prefix+'-Version'): version = v
global gYamon
gYamon.vadd('version-%s' % version, 1, wrap=10000000)
for replace in conn.parser.Header(prefix+'-Replace'):
if replace in self.conns.conns_by_id:
repl = self.conns.conns_by_id[replace]
self.LogInfo('Disconnecting old tunnel: %s' % repl)
self.conns.Remove(repl)
repl.Cleanup()
for bs in conn.parser.Header(prefix):
# X-Beanstalk: proto:my.domain.com:token:signature
proto, domain, srand, token, sign = bs.split(':')
requests.append((proto.lower(), domain.lower(), srand, token, sign,
prefix))
except Exception, err:
self.LogError('Discarding connection: %s' % err)
self.Cleanup()
return None
except socket.error, err:
self.LogInfo('Discarding connection: %s' % err)
self.Cleanup()
return None
self.CountAs('backends_live')
self.SetConn(conn)
conns.auth.check(requests[:], conn, lambda r: self.AuthCallback(conn, r))
return self
def RecheckQuota(self, conns, when=None):
if when is None: when = time.time()
if (self.quota and
self.quota[0] is not None and
self.quota[1] and
(self.quota[2] < when-900)):
self.quota[2] = when
LogDebug('Rechecking: %s' % (self.quota, ))
conns.auth.check([self.quota[1]], self,
lambda r: self.QuotaCallback(conns, r))
def QuotaCallback(self, conns, results):
# Report new values to the back-end...
if self.quota and (self.quota[0] >= 0): self.SendQuota()
for r in results:
if r[0] in ('X-PageKite-OK', 'X-PageKite-Duplicate'):
return self
self.LogInfo('Ran out of quota or account deleted, closing tunnel.')
conns.Remove(self)
self.Cleanup()
return None
def AuthCallback(self, conn, results):
output = [HTTP_ResponseHeader(200, 'OK'),
HTTP_Header('Content-Transfer-Encoding', 'chunked'),
HTTP_Header('X-PageKite-Features', 'ZChunks'),
HTTP_Header('X-PageKite-Protos', ', '.join(['%s' % p
for p in self.conns.config.server_protos])),
HTTP_Header('X-PageKite-Ports', ', '.join(
['%s' % self.conns.config.server_portalias.get(p, p)
for p in self.conns.config.server_ports]))]
if self.conns.config.server_raw_ports:
output.append(
HTTP_Header('X-PageKite-Raw-Ports',
', '.join(['%s' % p for p
in self.conns.config.server_raw_ports])))
ok = {}
for r in results:
if r[0] in ('X-PageKite-OK', 'X-Beanstalk-OK'): ok[r[1]] = 1
if r[0] == 'X-PageKite-SessionID': self.alt_id = r[1]
output.append('%s: %s\r\n' % r)
output.append(HTTP_StartBody())
if not self.Send(output, try_flush=True):
conn.LogDebug('No tunnels configured, closing connection (send failed).')
self.Cleanup()
return None
self.backends = ok.keys()
if self.backends:
for backend in self.backends:
proto, domain, srand = backend.split(':')
self.Log([('BE', 'Live'), ('proto', proto), ('domain', domain)])
self.conns.Tunnel(proto, domain, self)
if conn.quota:
self.quota = conn.quota
self.Log([('BE', 'Live'), ('quota', self.quota[0])])
self.conns.Add(self, alt_id=self.alt_id)
return self
else:
conn.LogDebug('No tunnels configured, closing connection.')
self.Cleanup()
return None
def _RecvHttpHeaders(self):
data = ''
while not data.endswith('\r\n\r\n') and not data.endswith('\n\n'):
try:
buf = self.fd.recv(4096)
except:
# This is sloppy, but the back-end will just connect somewhere else
# instead, so laziness here should be fine.
buf = None
if buf is None or buf == '':
LogDebug('Remote end closed connection.')
return None
data += buf
self.read_bytes += len(buf)
if DEBUG_IO: print '<== IN (headers)\n%s\n===' % data
return data
def _Connect(self, server, conns, tokens=None):
if self.fd: self.fd.close()
if conns.config.socks_server:
import socks
sock = socks.socksocket()
self.SetFD(sock)
else:
self.SetFD(rawsocket(socket.AF_INET, socket.SOCK_STREAM))
try:
self.fd.settimeout(20.0) # Missing in Python 2.2
except Exception:
self.fd.setblocking(1)
sspec = server.split(':')
if len(sspec) > 1:
self.fd.connect((sspec[0], int(sspec[1])))
else:
self.fd.connect((server, 443))
if self.conns.config.fe_certname:
# We can't set the SNI directly from Python, so we use CONNECT instead
commonName = self.conns.config.fe_certname[0].split('/')[0]
if (not self.Send(['CONNECT %s:443 HTTP/1.0\r\n\r\n' % commonName],
try_flush=True)
or not self.Flush(wait=True)):
return None, None
data = self._RecvHttpHeaders()
if data is None or not data.startswith(HTTP_ConnectOK().strip()):
LogError('CONNECT failed, could not initiate TLS.')
self.fd.close()
return None, None
try:
self.fd.setblocking(1)
raw_fd = self.fd
ctx = SSL.Context(SSL.TLSv1_METHOD)
ctx.load_verify_locations(self.conns.config.ca_certs)
self.fd = SSL_Connect(ctx, self.fd, connected=True, server_side=False,
verify_names=self.conns.config.fe_certname)
LogDebug('TLS connection to %s OK' % server)
except SSL.Error, e:
self.fd = raw_fd
self.fd.close()
LogError('SSL handshake failed: probably a bad cert (%s)' % e)
return None, None
replace_sessionid = self.conns.config.servers_sessionids.get(server, None)
if (not self.Send(HTTP_PageKiteRequest(server,
conns.config.backends,
tokens,
nozchunks=conns.config.disable_zchunks,
replace=replace_sessionid), try_flush=True)
or not self.Flush(wait=True)):
return None, None
data = self._RecvHttpHeaders()
if data is None: return None, None
self.fd.setblocking(0)
parse = HttpParser(lines=data.splitlines(), state=HttpParser.IN_RESPONSE)
return data, parse
def _BackEnd(server, backends, require_all, conns):
"""This is the back-end end of a tunnel."""
self = Tunnel(conns)
self.backends = backends
self.require_all = require_all
self.server_info[self.S_NAME] = server
try:
begin = time.time()
data, parse = self._Connect(server, conns)
if data and parse:
# Collect info about front-end capabilities, for interactive config
for portlist in parse.Header('X-PageKite-Ports'):
self.server_info[self.S_PORTS].extend(portlist.split(', '))
for portlist in parse.Header('X-PageKite-Raw-Ports'):
self.server_info[self.S_RAW_PORTS].extend(portlist.split(', '))
for protolist in parse.Header('X-PageKite-Protos'):
self.server_info[self.S_PROTOS].extend(protolist.split(', '))
for sessionid in parse.Header('X-PageKite-SessionID'):
self.alt_id = sessionid
conns.config.servers_sessionids[server] = sessionid
tryagain = False
tokens = {}
for request in parse.Header('X-PageKite-SignThis'):
proto, domain, srand, token = request.split(':')
tokens['%s:%s' % (proto, domain)] = token
tryagain = True
if tryagain:
begin = time.time()
data, parse = self._Connect(server, conns, tokens)
if data and parse:
if not conns.config.disable_zchunks:
for feature in parse.Header('X-PageKite-Features'):
if feature == 'ZChunks': self.EnableZChunks(level=9)
invalid_reasons = {}
for request in parse.Header('X-PageKite-Invalid-Why'):
# This is future-compatible, in that we can add more fields later.
details = request.split(';')
invalid_reasons[details[0]] = details[1]
for request in parse.Header('X-PageKite-Invalid'):
proto, domain, srand = request.split(':')
reason = invalid_reasons.get(request, 'unknown')
self.Log([('FE', self.server_info[self.S_NAME]),
('err', 'Rejected'),
('proto', proto),
('reason', reason),
('domain', domain)])
for request in parse.Header('X-PageKite-Duplicate'):
proto, domain, srand = request.split(':')
self.Log([('FE', self.server_info[self.S_NAME]),
('err', 'Duplicate'),
('proto', proto),
('domain', domain)])
for quota in parse.Header('X-PageKite-Quota'):
self.quota = [int(quota), None, None]
self.Log([('FE', self.server_info[self.S_NAME]),
('quota', quota)])
ssl_available = {}
for request in parse.Header('X-PageKite-SSL-OK'):
ssl_available[request] = True
for request in parse.Header('X-PageKite-OK'):
abort = False
proto, domain, srand = request.split(':')
conns.Tunnel(proto, domain, self)
if request in ssl_available:
self.remote_ssl[(proto, domain)] = True
self.Log([('FE', self.server_info[self.S_NAME]),
('proto', proto),
('ssl', (request in ssl_available)),
('domain', domain)])
self.rtt = (time.time() - begin)
except socket.error, e:
self.Cleanup()
return None
except Exception, e:
self.LogError('Server response parsing failed: %s' % e)
self.Cleanup()
return None
conns.Add(self)
self.CountAs('frontends_live')
return self
FrontEnd = staticmethod(_FrontEnd)
BackEnd = staticmethod(_BackEnd)
def SendData(self, conn, data, sid=None, host=None, proto=None, port=None,
chunk_headers=None):
sid = int(sid or conn.sid)
if conn: self.users[sid] = conn
if not sid in self.zhistory: self.zhistory[sid] = [0, 0]
sending = ['SID: %s\r\n' % sid]
if proto: sending.append('Proto: %s\r\n' % proto)
if host: sending.append('Host: %s\r\n' % host)
if port:
porti = int(port)
if porti in self.conns.config.server_portalias:
sending.append('Port: %s\r\n' % self.conns.config.server_portalias[porti])
else:
sending.append('Port: %s\r\n' % port)
if chunk_headers:
for ch in chunk_headers: sending.append('%s: %s\r\n' % ch)
sending.append('\r\n')
sending.append(data)
return self.SendChunked(sending, zhistory=self.zhistory[sid])
def SendStreamEof(self, sid, write_eof=False, read_eof=False):
return self.SendChunked('SID: %s\r\nEOF: 1%s%s\r\n\r\nBye!' % (sid,
(write_eof or not read_eof) and 'W' or '',
(read_eof or not write_eof) and 'R' or ''))
def EofStream(self, sid, eof_type='WR'):
if sid in self.users and self.users[sid] is not None:
write_eof = (-1 != eof_type.find('W'))
read_eof = (-1 != eof_type.find('R'))
self.users[sid].ProcessTunnelEof(read_eof=(read_eof or not write_eof),
write_eof=(write_eof or not read_eof))
def CloseStream(self, sid, stream_closed=False):
if sid in self.users:
stream = self.users[sid]
del self.users[sid]
if not stream_closed and stream is not None:
stream.CloseTunnel(tunnel_closed=True)
if sid in self.zhistory:
del self.zhistory[sid]
def Cleanup(self, close=True):
if self.users:
for sid in self.users.keys(): self.CloseStream(sid)
ChunkParser.Cleanup(self, close=close)
self.conns = None
self.users = self.zhistory = self.backends = {}
def ResetRemoteZChunks(self):
return self.SendChunked('NOOP: 1\r\nZRST: 1\r\n\r\n!', compress=False)
def SendPing(self):
self.last_ping = int(time.time())
self.LogDebug("Ping", [('host', self.server_info[self.S_NAME])])
return self.SendChunked('NOOP: 1\r\nPING: 1\r\n\r\n!', compress=False)
def SendPong(self):
return self.SendChunked('NOOP: 1\r\n\r\n!', compress=False)
def SendQuota(self):
return self.SendChunked('NOOP: 1\r\nQuota: %s\r\n\r\n!' % self.quota[0],
compress=False)
def SendThrottle(self, sid, write_speed):
return self.SendChunked('NOOP: 1\r\nSID: %s\r\nSPD: %d\r\n\r\n!' % (
sid, write_speed), compress=False)
def ProcessCorruptChunk(self, data):
self.ResetRemoteZChunks()
return True
def Probe(self, host):
for bid in self.conns.config.backends:
be = self.conns.config.backends[bid]
if be[BE_DOMAIN] == host:
bhost, bport = be[BE_BACKEND].split(':')
if self.conns.config.Ping(bhost, int(bport)) > 2: return False
return True
def Throttle(self, parse):
try:
sid = int(parse.Header('SID')[0])
bps = int(parse.Header('SPD')[0])
if sid in self.users: self.users[sid].Throttle(bps, remote=True)
except Exception, e:
LogError('Tunnel::ProcessChunk: Invalid throttle request!')
return True
# If a tunnel goes down, we just go down hard and kill all our connections.
def ProcessEofRead(self):
if self.conns: self.conns.Remove(self)
self.Cleanup()
return True
def ProcessEofWrite(self):
return self.ProcessEofRead()
def ProcessChunk(self, data):
try:
headers, data = data.split('\r\n\r\n', 1)
parse = HttpParser(lines=headers.splitlines(),
state=HttpParser.IN_HEADERS)
except ValueError:
LogError('Tunnel::ProcessChunk: Corrupt packet!')
return False
self.last_activity = time.time()
try:
if parse.Header('Quota'):
if self.quota:
self.quota[0] = int(parse.Header('Quota')[0])
else:
self.quota = [int(parse.Header('Quota')[0]), None, None]
if parse.Header('PING'): return self.SendPong()
if parse.Header('ZRST') and not self.ResetZChunks(): return False
if parse.Header('SPD') and not self.Throttle(parse): return False
if parse.Header('NOOP'): return True
except Exception, e:
LogError('Tunnel::ProcessChunk: Corrupt chunk: %s' % e)
return False
conn = None
sid = None
try:
sid = int(parse.Header('SID')[0])
eof = parse.Header('EOF')
except IndexError, e:
LogError('Tunnel::ProcessChunk: Corrupt packet!')
return False
if eof:
self.EofStream(sid, eof[0])
else:
if sid in self.users:
conn = self.users[sid]
else:
proto = (parse.Header('Proto') or [''])[0].lower()
port = (parse.Header('Port') or [''])[0].lower()
host = (parse.Header('Host') or [''])[0].lower()
rIp = (parse.Header('RIP') or [''])[0].lower()
rPort = (parse.Header('RPort') or [''])[0].lower()
if proto and host:
# FIXME:
# if proto == 'https':
# if host in self.conns.config.tls_endpoints:
# print 'Should unwrap SSL from %s' % host
if proto == 'probe':
if self.conns.config.no_probes:
LogDebug('Responding to probe for %s: rejected' % host)
if not self.SendChunked('SID: %s\r\n\r\n%s' % (
sid, HTTP_NoFeConnection() )):
return False
elif self.Probe(host):
LogDebug('Responding to probe for %s: good' % host)
if not self.SendChunked('SID: %s\r\n\r\n%s' % (
sid, HTTP_GoodBeConnection() )):
return False
else:
LogDebug('Responding to probe for %s: back-end down' % host)
if not self.SendChunked('SID: %s\r\n\r\n%s' % (
sid, HTTP_NoBeConnection() )):
return False
else:
conn = UserConn.BackEnd(proto, host, sid, self, port,
remote_ip=rIp, remote_port=rPort)
if proto in ('http', 'websocket'):
if not conn:
if not self.SendChunked('SID: %s\r\n\r\n%s' % (sid,
HTTP_Unavailable('be', proto, host,
frame_url=self.conns.config.error_url) )):
return False
elif rIp:
req, rest = re.sub(r'(?mi)^x-forwarded-for', 'X-Old-Forwarded-For', data
).split('\n', 1)
data = ''.join([req, '\nX-Forwarded-For: %s\r\n' % rIp, rest])
if conn:
self.users[sid] = conn
if not conn:
self.CloseStream(sid)
if not self.SendStreamEof(sid): return False
else:
if not conn.Send(data):
# FIXME
pass
if len(conn.write_blocked) > 2*max(conn.write_speed, 50000):
if conn.created < time.time()-3:
if not self.SendThrottle(sid, conn.write_speed): return False
return True
class LoopbackTunnel(Tunnel):
"""A Tunnel which just loops back to this process."""
def __init__(self, conns, which, backends):
Tunnel.__init__(self, conns)
self.backends = backends
self.require_all = True
self.server_info[self.S_NAME] = LOOPBACK[which]
self.other_end = None
if which == 'FE':
for d in backends.keys():
if backends[d][BE_BACKEND]:
proto, domain = d.split(':')
self.conns.Tunnel(proto, domain, self)
self.Log([('FE', self.server_info[self.S_NAME]),
('proto', proto),
('domain', domain)])
def Cleanup(self, close=True):
Tunnel.Cleanup(self, close=close)
other = self.other_end
self.other_end = None
if other and other.other_end: other.Cleanup()
def Linkup(self, other):
self.other_end = other
other.other_end = self
def _Loop(conns, backends):
return LoopbackTunnel(conns, 'FE', backends
).Linkup(LoopbackTunnel(conns, 'BE', backends))
Loop = staticmethod(_Loop)
def Send(self, data):
return self.other_end.ProcessData(''.join(data))
class UserConn(Selectable):
"""A Selectable representing a user's connection."""
def __init__(self, address):
Selectable.__init__(self, address=address)
self.tunnel = None
self.conns = None
def __html__(self):
return ('Tunnel: %s '
'%s') % (self.tunnel and self.tunnel.sid or '',
escape_html('%s' % (self.tunnel or '')),
Selectable.__html__(self))
def CloseTunnel(self, tunnel_closed=False):
tunnel = self.tunnel
self.tunnel = None
if tunnel and not tunnel_closed:
if not self.read_eof or not self.write_eof:
tunnel.SendStreamEof(self.sid, write_eof=True, read_eof=True)
tunnel.CloseStream(self.sid, stream_closed=True)
self.ProcessTunnelEof(read_eof=True, write_eof=True)
def Cleanup(self, close=True):
if close:
self.CloseTunnel()
Selectable.Cleanup(self, close=close)
if self.conns:
self.conns.Remove(self)
self.conns = None
def _FrontEnd(conn, address, proto, host, on_port, body, conns):
# This is when an external user connects to a server and requests a
# web-page. We have to give it to them!
self = UserConn(address)
self.conns = conns
self.SetConn(conn)
if ':' in host: host, port = host.split(':', 1)
self.proto = proto
self.host = host
# If the listening port is an alias for another...
if int(on_port) in conns.config.server_portalias:
on_port = conns.config.server_portalias[int(on_port)]
# Try and find the right tunnel. We prefer proto/port specifications first,
# then the just the proto. If the protocol is WebSocket and no tunnel is
# found, look for a plain HTTP tunnel.
if proto == 'probe':
protos = ['http', 'https', 'websocket', 'raw']
ports = conns.config.server_ports[:]
ports.extend(conns.config.server_aliasport.keys())
ports.extend([x for x in conns.config.server_raw_ports if x != VIRTUAL_PN])
else:
protos = [proto]
ports = [on_port]
if proto == 'websocket': protos.append('http')
tunnels = None
for p in protos:
for prt in ports:
if not tunnels: tunnels = conns.Tunnel('%s-%s' % (p, prt), host)
if not tunnels: tunnels = conns.Tunnel(p, host)
if not tunnels: tunnels = conns.Tunnel(protos[0], CATCHALL_HN)
if self.address:
chunk_headers = [('RIP', self.address[0]), ('RPort', self.address[1])]
if tunnels: self.tunnel = tunnels[0]
if (self.tunnel and self.tunnel.SendData(self, ''.join(body), host=host,
proto=proto, port=on_port,
chunk_headers=chunk_headers)
and self.conns):
self.Log([('domain', self.host), ('on_port', on_port), ('proto', self.proto), ('is', 'FE')])
self.conns.Add(self)
self.conns.TrackIP(address[0], host)
# FIXME: Use the tracked data to detect & mitigate abuse?
return self
else:
self.LogDebug('No back-end', [('on_port', on_port), ('proto', self.proto),
('domain', self.host), ('is', 'FE')])
self.Cleanup(close=False)
return None
def _BackEnd(proto, host, sid, tunnel, on_port, remote_ip=None, remote_port=None):
# This is when we open a backend connection, because a user asked for it.
self = UserConn(None)
self.sid = sid
self.proto = proto
self.host = host
self.conns = tunnel.conns
self.tunnel = tunnel
# Try and find the right back-end. We prefer proto/port specifications
# first, then the just the proto. If the protocol is WebSocket and no
# tunnel is found, look for a plain HTTP tunnel.
backend = None
protos = [proto]
if proto == 'probe': protos = ['http']
if proto == 'websocket': protos.append('http')
for p in protos:
if not backend: backend = self.conns.config.GetBackendServer('%s-%s' % (p, on_port), host)
if not backend: backend = self.conns.config.GetBackendServer(p, host)
if not backend: backend = self.conns.config.GetBackendServer(p, CATCHALL_HN)
logInfo = [
('on_port', on_port),
('proto', proto),
('domain', host),
('is', 'BE')
]
if remote_ip: logInfo.append(('remote_ip', remote_ip))
if not backend:
logInfo.append(('err', 'No back-end'))
self.Log(logInfo)
self.Cleanup(close=False)
return None
try:
self.SetFD(rawsocket(socket.AF_INET, socket.SOCK_STREAM))
try:
self.fd.settimeout(2.0) # Missing in Python 2.2
except Exception:
self.fd.setblocking(1)
sspec = backend.split(':')
if len(sspec) > 1:
self.fd.connect((sspec[0], int(sspec[1])))
else:
self.fd.connect((backend, 80))
self.fd.setblocking(0)
except socket.error, err:
logInfo.append(('socket_error', '%s' % err))
self.Log(logInfo)
self.Cleanup(close=False)
return None
self.Log(logInfo)
self.conns.Add(self)
return self
FrontEnd = staticmethod(_FrontEnd)
BackEnd = staticmethod(_BackEnd)
def Shutdown(self, direction):
try:
if self.fd:
if 'sock_shutdown' in dir(self.fd):
# This is a pyOpenSSL socket, which has incompatible shutdown.
if direction == socket.SHUT_RD:
self.fd.shutdown()
else:
self.fd.sock_shutdown(direction)
else:
self.fd.shutdown(direction)
except Exception, e:
pass
def ProcessTunnelEof(self, read_eof=False, write_eof=False):
if read_eof and not self.write_eof:
self.ProcessEofWrite(tell_tunnel=False)
if write_eof and not self.read_eof:
self.ProcessEofRead(tell_tunnel=False)
return True
def ProcessEofRead(self, tell_tunnel=True):
self.read_eof = True
self.Shutdown(socket.SHUT_RD)
if tell_tunnel and self.tunnel:
self.tunnel.SendStreamEof(self.sid, read_eof=True)
return self.ProcessEof()
def ProcessEofWrite(self, tell_tunnel=True):
self.write_eof = True
if not self.write_blocked: self.Shutdown(socket.SHUT_WR)
if tell_tunnel and self.tunnel:
self.tunnel.SendStreamEof(self.sid, write_eof=True)
return self.ProcessEof()
def Send(self, data, try_flush=False):
rv = Selectable.Send(self, data, try_flush=try_flush)
if self.write_eof and not self.write_blocked:
self.Shutdown(socket.SHUT_WR)
return rv
def ProcessData(self, data):
if not self.tunnel:
self.LogError('No tunnel! %s' % self)
return False
if not self.tunnel.SendData(self, data):
self.LogDebug('Send to tunnel failed')
return False
# Back off if tunnel is stuffed.
if self.tunnel and len(self.tunnel.write_blocked) > 1024000:
self.Throttle(delay=(len(self.tunnel.write_blocked)-204800)/max(50000, self.tunnel.write_speed))
if self.read_eof: return self.ProcessEofRead()
return True
class UnknownConn(MagicProtocolParser):
"""This class is a connection which we're not sure what is yet."""
def __init__(self, fd, address, on_port, conns):
MagicProtocolParser.__init__(self, fd, address, on_port)
self.peeking = True
self.parser = HttpParser()
self.conns = conns
self.conns.Add(self)
self.sid = -1
self.host = None
self.proto = None
def Cleanup(self, close=True):
if self.conns: self.conns.Remove(self)
MagicProtocolParser.Cleanup(self, close=close)
self.conns = self.parser = None
def __str__(self):
return '%s (%s/%s:%s)' % (MagicProtocolParser.__str__(self),
(self.proto or '?'),
(self.on_port or '?'),
(self.host or '?'))
def ProcessEofRead(self):
self.read_eof = True
return self.ProcessEof()
def ProcessEofWrite(self):
self.read_eof = True
return self.ProcessEof()
def ProcessLine(self, line, lines):
if not self.parser: return True
if self.parser.Parse(line) is False: return False
if self.parser.state != self.parser.IN_BODY: return True
done = False
if self.parser.method == 'PING':
self.Send('PONG %s\r\n\r\n' % self.parser.path)
self.read_eof = self.write_eof = done = True
self.fd.close()
elif self.parser.method == 'CONNECT':
if self.parser.path.lower().startswith('pagekite:'):
if Tunnel.FrontEnd(self, lines, self.conns) is None: return False
done = True
else:
try:
connect_parser = self.parser
chost, cport = connect_parser.path.split(':', 1)
cport = int(cport)
chost = chost.lower()
sid1 = ':%s' % chost
sid2 = '-%s:%s' % (cport, chost)
tunnels = self.conns.tunnels
# These allow explicit CONNECTs to direct https or raw backends.
# If no match is found, we fall through to default HTTP processing.
if cport == 443:
if (('https'+sid1) in tunnels) or (
('https'+sid2) in tunnels) or (
chost in self.conns.config.tls_endpoints):
(self.on_port, self.host) = (cport, chost)
self.parser = HttpParser()
self.Send(HTTP_ConnectOK())
return self.ProcessTls(''.join(lines), chost)
if (cport in self.conns.config.server_raw_ports or
VIRTUAL_PN in self.conns.config.server_raw_ports):
if (('raw'+sid1) in tunnels) or (('raw'+sid2) in tunnels):
(self.on_port, self.host) = (cport, chost)
self.parser = HttpParser()
self.Send(HTTP_ConnectOK())
return self.ProcessRaw(''.join(lines), self.host)
except ValueError:
pass
if (not done and self.parser.method == 'POST'
and self.parser.path in MAGIC_PATHS):
# FIXME: DEPRECATE: Make this go away!
if Tunnel.FrontEnd(self, lines, self.conns) is None: return False
done = True
if not done:
if not self.host:
hosts = self.parser.Header('Host')
if hosts:
self.host = hosts[0].lower()
else:
self.Send(HTTP_Response(400, 'Bad request',
['
400 Bad request
',
'
Invalid request, no Host: found.
',
'']))
return False
if self.parser.path.startswith(MAGIC_PREFIX):
try:
self.host = self.parser.path.split('/')[2]
self.proto = 'probe'
except ValueError:
pass
if self.proto is None:
self.proto = 'http'
upgrade = self.parser.Header('Upgrade')
if 'websocket' in self.conns.config.server_protos:
if upgrade and upgrade[0].lower() == 'websocket':
self.proto = 'websocket'
address = self.address
if int(self.on_port) in self.conns.config.server_portalias:
xfwdf = self.parser.Header('X-Forwarded-For')
if xfwdf and address[0] == '127.0.0.1':
address = (xfwdf[0], address[1])
done = True
if UserConn.FrontEnd(self, address,
self.proto, self.host, self.on_port,
self.parser.lines + lines, self.conns) is None:
if self.proto == 'probe':
self.Send(HTTP_NoFeConnection())
else:
self.Send(HTTP_Unavailable('fe', self.proto, self.host,
frame_url=self.conns.config.error_url))
return False
# We are done!
self.Cleanup(close=False)
return True
def ProcessTls(self, data, domain=None):
if domain:
domains = [domain]
else:
try:
domains = self.GetSni(data)
if not domains:
domains = [self.conns.LastIpDomain(self.address[0]) or self.conns.config.tls_default]
LogDebug('No SNI - trying: %s' % domains[0])
if not domains[0]: domains = None
except Exception:
# Probably insufficient data, just return True and assume we'll have
# better luck on the next round.
return True
if domains:
# If we know how to terminate the TLS/SSL, do so!
ctx = self.conns.config.GetTlsEndpointCtx(domains[0])
if ctx:
self.fd = SSL_Connect(ctx, self.fd, accepted=True, server_side=True)
self.peeking = False
self.is_tls = False
return True
if domains and domains[0] is not None:
self.EatPeeked()
if UserConn.FrontEnd(self, self.address,
'https', domains[0], self.on_port,
[data], self.conns) is None:
return False
# We are done!
self.Cleanup(close=False)
return True
def ProcessRaw(self, data, domain):
if UserConn.FrontEnd(self, self.address,
'raw', domain, self.on_port,
[data], self.conns) is None:
return False
# We are done!
self.Cleanup(close=False)
return True
class RawConn(Selectable):
"""This class is a raw/timed connection."""
def __init__(self, fd, address, on_port, conns):
Selectable.__init__(self, fd, address, on_port)
domain = conns.LastIpDomain(address[0])
if domain and UserConn.FrontEnd(self, address, 'raw', domain, on_port,
[], conns):
self.Cleanup(close=False)
else:
self.Cleanup()
class Listener(Selectable):
"""This class listens for incoming connections and accepts them."""
def __init__(self, host, port, conns, backlog=100, connclass=UnknownConn):
Selectable.__init__(self)
self.fd.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
self.fd.bind((host, port))
self.fd.listen(backlog)
self.fd.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
self.Log([('listen', '%s:%s' % (host, port))])
self.connclass = connclass
self.port = port
self.conns = conns
self.conns.Add(self)
def __str__(self):
return '%s port=%s' % (Selectable.__str__(self), self.port)
def __html__(self):
return '
Listening on port %s
' % self.port
def ReadData(self, maxread=None):
try:
client, address = self.fd.accept()
if client:
self.Log([('accept', '%s:%s' % (obfuIp(address[0]), address[1]))])
uc = self.connclass(client, address, self.port, self.conns)
return True
except Exception, e:
LogDebug('Listener::ReadData: %s' % e)
return False
class TunnelManager(threading.Thread):
"""Create new tunnels as necessary or kill idle ones."""
def __init__(self, pkite, conns):
threading.Thread.__init__(self)
self.pkite = pkite
self.conns = conns
def CheckTunnelQuotas(self, now):
for tid in self.conns.tunnels:
for tunnel in self.conns.tunnels[tid]:
tunnel.RecheckQuota(self.conns, when=now)
def PingTunnels(self, now):
dead = {}
for tid in self.conns.tunnels:
for tunnel in self.conns.tunnels[tid]:
grace = max(40, len(tunnel.write_blocked)/(tunnel.write_speed or 0.001))
if tunnel.last_activity < tunnel.last_ping-(5+grace):
dead['%s' % tunnel] = tunnel
elif tunnel.last_activity < now-30 and tunnel.last_ping < now-2:
tunnel.SendPing()
for tunnel in dead.values():
Log([('dead', tunnel.server_info[tunnel.S_NAME])])
self.conns.Remove(tunnel)
tunnel.Cleanup()
def quit(self):
self.keep_running = False
def run(self):
self.keep_running = True
while self.keep_running:
try:
self._run()
except Exception, e:
LogError('TunnelManager died: %s' % e)
time.sleep(5)
def _run(self):
check_interval = 5
while self.keep_running:
# Reconnect if necessary, randomized exponential fallback.
if self.pkite.CreateTunnels(self.conns) > 0:
check_interval += int(random.random()*check_interval)
if check_interval > 300: check_interval = 300
else:
check_interval = 5
# If all connected, make sure tunnels are really alive.
if self.pkite.isfrontend:
self.CheckTunnelQuotas(time.time())
# FIXME: Front-ends should close dead back-end tunnels.
else:
self.PingTunnels(time.time())
for i in xrange(0, check_interval):
if self.keep_running: time.sleep(1)
class PageKite(object):
"""Configuration and master select loop."""
def __init__(self):
self.isfrontend = False
self.motd = None
self.upgrade_info = []
self.auth_domain = None
self.auth_help_url = None
self.server_host = ''
self.server_ports = [80]
self.server_raw_ports = []
self.server_portalias = {}
self.server_aliasport = {}
self.server_protos = ['http', 'https', 'websocket', 'raw']
self.tls_default = None
self.tls_endpoints = {}
self.fe_certname = []
self.daemonize = False
self.pidfile = None
self.logfile = None
self.setuid = None
self.setgid = None
self.ui_request_handler = UiRequestHandler
self.ui_http_server = UiHttpServer
self.ui_sspec = None
self.ui_httpd = None
self.ui_password = None
self.ui_pemfile = None
self.disable_zchunks = False
self.enable_sslzlib = False
self.buffer_max = 1024
self.error_url = None
self.tunnel_manager = None
self.client_mode = 0
self.socks_server = None
self.require_all = False
self.no_probes = False
self.servers = []
self.servers_manual = []
self.servers_auto = None
self.servers_new_only = False
self.servers_no_ping = False
self.servers_preferred = []
self.servers_sessionids = {}
self.dyndns = None
self.last_updates = []
self.backends = {} # These are the backends we want tunnels for.
self.conns = None
self.looping = False
self.main_loop = True
self.crash_report_url = '%scgi-bin/crashes.pl' % WWWHOME
self.rcfile_recursion = 0
self.rcfiles_loaded = []
self.savefile = None
self.reloadfile = None
# Searching for our configuration file! We prefer the documented
# 'standard' locations, but if nothing is found there and something local
# exists, use that instead.
try:
if os.getenv('USERPROFILE'):
# Windows
self.rcfile = os.path.join(os.getenv('USERPROFILE'), 'pagekite.cfg')
self.devnull = 'nul'
else:
# Everything else
self.rcfile = os.path.join(os.getenv('HOME'), '.pagekite.rc')
self.devnull = '/dev/null'
except Exception, e:
# The above stuff may fail in some cases, e.g. on Android in SL4A.
self.rcfile = 'pagekite.cfg'
self.devnull = '/dev/null'
if not os.path.exists(self.rcfile):
for rcf in ('pagekite.rc', 'pagekite.cfg'):
prog_rcf = os.path.join(os.path.dirname(sys.argv[0]), rcf)
if os.path.exists(prog_rcf): self.rcfile = prog_rcf
elif os.path.exists(rcf): self.rcfile = rcf
# Look for CA Certificates. If we don't find them in the host OS,
# we assume there might be something good in the config file.
self.ca_certs_default = '/etc/ssl/certs/ca-certificates.crt'
if not os.path.exists(self.ca_certs_default):
self.ca_certs_default = self.rcfile
self.ca_certs = self.ca_certs_default
def PrintSettings(self):
print '### Current settings for PageKite v%s. ###' % APPVER
print
print '# HTTP control-panel settings:'
print (self.ui_sspec and 'httpd=%s:%d' % self.ui_sspec or '#httpd=host:port')
print (self.ui_password and 'httppass=%s' % self.ui_password or '#httppass=YOURSECRET')
print (self.ui_pemfile and 'pemfile=%s' % self.ui_pemfile or '#pemfile=/path/to/sslcert.pem')
print
print '# Back-end Options:'
print (self.servers_auto and 'frontends=%d:%s:%d' % self.servers_auto or '#frontends=1:frontends.b5p.us:443')
for server in self.servers_manual:
print 'frontend=%s' % server
for server in self.fe_certname:
print 'fe_certname=%s' % server
if self.dyndns:
provider, args = self.dyndns
for prov in DYNDNS:
if DYNDNS[prov] == provider and prov != 'beanstalks.net':
args['prov'] = prov
if 'prov' not in args:
args['prov'] = provider
if args['pass']:
print 'dyndns=%(user)s:%(pass)s@%(prov)s' % args
elif args['user']:
print 'dyndns=%(user)s@%(prov)s' % args
else:
print 'dyndns=%(prov)s' % args
else:
print '#dyndns=pagekite.net OR'
print '#dyndns=user:pass@dyndns.org OR'
print '#dyndns=user:pass@no-ip.com'
bprinted = 0
for bid in self.backends:
be = self.backends[bid]
if be[BE_BACKEND]:
print 'backend=%s:%s:%s' % (bid, be[BE_BACKEND], be[BE_SECRET])
bprinted += 1
if bprinted == 0:
print '#backend=http:YOU.pagekite.me:localhost:80:SECRET'
print '#backend=https:YOU.pagekite.me:localhost:443:SECRET'
print '#backend=websocket:YOU.pagekite.me:localhost:8080:SECRET'
print (self.error_url and ('errorurl=%s' % self.error_url) or '#errorurl=http://host/page/')
print (self.servers_new_only and 'new' or '#new')
print (self.require_all and 'all' or '#all')
print (self.no_probes and 'noprobes' or '#noprobes')
print
eprinted = 0
print '# Domains we terminate SSL/TLS for natively, with key/cert-files'
for ep in self.tls_endpoints:
print 'tls_endpoint=%s:%s' % (ep, self.tls_endpoints[ep][0])
eprinted += 1
if eprinted == 0:
print '#tls_endpoint=DOMAIN:PEM_FILE'
print (self.tls_default and 'tls_default=%s' % self.tls_default or '#tls_default=DOMAIN')
print
print
print '### The following stuff can usually be ignored. ###'
print
print '# Includes (should usually be at the top of the file)'
print '#optfile=/path/to/common/settings'
print
print '# Front-end Options:'
print (self.isfrontend and 'isfrontend' or '#isfrontend')
comment = (self.isfrontend and '' or '#')
print (self.server_host and '%shost=%s' % (comment, self.server_host) or '#host=machine.domain.com')
print '%sports=%s' % (comment, ','.join(['%s' % x for x in self.server_ports] or []))
print '%sprotos=%s' % (comment, ','.join(['%s' % x for x in self.server_protos] or []))
for pa in self.server_portalias:
print 'portalias=%s:%s' % (int(pa), int(self.server_portalias[pa]))
print '%srawports=%s' % (comment, ','.join(['%s' % x for x in self.server_raw_ports] or []))
print (self.auth_domain and '%sauthdomain=%s' % (comment, self.auth_domain) or '#authdomain=foo.com')
for bid in self.backends:
be = self.backends[bid]
if not be[BE_BACKEND]:
print 'domain=%s:%s' % (bid, be[BE_SECRET])
print '#domain=http:*.pagekite.me:SECRET1'
print '#domain=http,https,websocket:THEM.pagekite.me:SECRET2'
print
print '# Systems administration settings:'
print (self.logfile and 'logfile=%s' % self.logfile or '#logfile=/path/file')
print (self.daemonize and 'daemonize' % self.logfile or '#daemonize')
if self.setuid and self.setgid:
print 'runas=%s:%s' % (self.setuid, self.setgid)
elif self.setuid:
print 'runas=%s' % self.setuid
else:
print '#runas=uid:gid'
print (self.pidfile and 'pidfile=%s' % self.pidfile or '#pidfile=/path/file')
if self.ca_certs != self.ca_certs_default:
print 'ca_certs=%s' % self.ca_certs
else:
print '#ca_certs=%s' % self.ca_certs
print
def FallDown(self, message, help=True, noexit=False):
if self.conns and self.conns.auth: self.conns.auth.quit()
if self.ui_httpd: self.ui_httpd.quit()
if self.tunnel_manager: self.tunnel_manager.quit()
self.conns = self.ui_httpd = self.tunnel_manager = None
if help:
print DOC
print '*****'
if message: print 'Error: %s' % message
if not noexit: sys.exit(1)
def GetTlsEndpointCtx(self, domain):
if domain in self.tls_endpoints: return self.tls_endpoints[domain][1]
parts = domain.split('.')
# Check for wildcards ...
while len(parts) > 2:
parts[0] = '*'
domain = '.'.join(parts)
if domain in self.tls_endpoints: return self.tls_endpoints[domain][1]
parts.pop(0)
return None
def GetBackendData(self, proto, domain, field, recurse=True):
backend = '%s:%s' % (proto.lower(), domain.lower())
if backend in self.backends:
if BE_STATUS_DISABLED != self.backends[backend][BE_STATUS]:
return self.backends[backend][field]
if recurse:
dparts = domain.split('.')
while len(dparts) > 1:
dparts = dparts[1:]
data = self.GetBackendData(proto, '.'.join(['*'] + dparts), field, recurse=False)
if data: return data
return None
def GetBackendServer(self, proto, domain, recurse=True):
server = self.GetBackendData(proto, domain, BE_BACKEND)
if server == '-': return None
return server
def IsSignatureValid(self, sign, secret, proto, domain, srand, token):
return checkSignature(sign=sign, secret=secret,
payload='%s:%s:%s:%s' % (proto, domain, srand, token))
def LookupDomainQuota(self, lookup):
if not lookup.endswith('.'): lookup += '.'
if DEBUG_IO: print '=== AUTH LOOKUP\n%s\n===' % lookup
(hn, al, ips) = socket.gethostbyname_ex(lookup)
# Extract auth error hints from domain name, if we got a CNAME reply.
if al:
error = hn.split('.')[0]
else:
error = None
# If not an authentication error, quota should be encoded as an IP.
ip = ips[0]
if not ip.startswith(AUTH_ERRORS):
o = [int(x) for x in ip.split('.')]
return ((((o[0]*256 + o[1])*256 + o[2])*256 + o[3]), None)
# Errors on real errors are final.
if not ip.endswith(AUTH_ERR_USER_UNKNOWN): return (None, error)
# User unknown, fall through to local test.
return (-1, error)
def GetDomainQuota(self, protoport, domain, srand, token, sign,
recurse=True, check_token=True):
if '-' in protoport:
try:
proto, port = protoport.split('-', 1)
if proto == 'raw':
port_list = self.server_raw_ports
else:
port_list = self.server_ports
porti = int(port)
if porti in self.server_aliasport: porti = self.server_aliasport[porti]
if porti not in port_list and VIRTUAL_PN not in port_list:
LogInfo('Unsupported port request: %s (%s:%s)' % (porti, protoport, domain))
return (None, 'port')
except ValueError:
LogError('Invalid port request: %s:%s' % (protoport, domain))
return (None, 'port')
else:
proto, port = protoport, None
if proto not in self.server_protos:
LogInfo('Invalid proto request: %s:%s' % (protoport, domain))
return (None, 'proto')
data = '%s:%s:%s' % (protoport, domain, srand)
auth_error_type = None
if (not token) or (not check_token) or checkSignature(sign=token, payload=data):
if self.auth_domain:
try:
lookup = '.'.join([srand, token, sign, protoport, domain, self.auth_domain])
(rv, auth_error_type) = self.LookupDomainQuota(lookup)
if rv is None or rv >= 0: return (rv, auth_error_type)
except Exception, e:
# Lookup failed, fail open.
LogError('Quota lookup failed: %s' % e)
return (-2, None)
secret = self.GetBackendData(protoport, domain, BE_SECRET)
if not secret: secret = self.GetBackendData(proto, domain, BE_SECRET)
if secret:
if self.IsSignatureValid(sign, secret, protoport, domain, srand, token):
return (-1, None)
else:
LogError('Invalid signature for: %s (%s)' % (domain, protoport))
return (None, auth_error_type or 'signature')
LogInfo('No authentication found for: %s (%s)' % (domain, protoport))
return (None, auth_error_type or 'auth')
def ConfigureFromFile(self, filename=None):
if not filename: filename = self.rcfile
if self.rcfile_recursion > 25:
raise ConfigError('Nested too deep: %s' % filename)
self.rcfiles_loaded.append(filename)
optfile = open(filename)
args = []
for line in optfile:
line = line.strip()
if line and not line.startswith('#'):
if line.startswith('END'): break
if not line.startswith('-'): line = '--%s' % line
args.append(line)
self.rcfile_recursion += 1
self.Configure(args)
self.rcfile_recursion -= 1
return self
def HelpAndExit(self):
print DOC
sys.exit(0)
def Configure(self, argv):
opts, args = getopt.getopt(argv, OPT_FLAGS, OPT_ARGS)
# Complain about crap on the command-line.
if args: raise ConfigError("Unknown arguments: %s" % args)
for opt, arg in opts:
if opt in ('-o', '--optfile'): self.ConfigureFromFile(arg)
elif opt == '--reloadfile':
self.ConfigureFromFile(arg)
self.reloadfile = arg
elif opt in ('-S', '--savefile'):
if self.savefile: raise ConfigError('Multiple save-files!')
self.ConfigureFromFile(arg)
self.savefile = arg
elif opt in ('-I', '--pidfile'): self.pidfile = arg
elif opt in ('-L', '--logfile'): self.logfile = arg
elif opt in ('-Z', '--daemonize'): self.daemonize = True
elif opt in ('-U', '--runas'):
import pwd
import grp
parts = arg.split(':')
if len(parts) > 1:
self.setuid, self.setgid = (pwd.getpwnam(parts[0])[2],
grp.getgrnam(parts[1])[2])
else:
self.setuid = pwd.getpwnam(parts[0])[2]
self.main_loop = False
elif opt in ('-X', '--httppass'): self.ui_password = arg
elif opt in ('-P', '--pemfile'): self.ui_pemfile = arg
elif opt in ('-H', '--httpd'):
parts = arg.split(':')
host = parts[0] or 'localhost'
if len(parts) > 1:
self.ui_sspec = (host, int(parts[1]))
else:
self.ui_sspec = (host, 80)
elif opt == '--tls_default': self.tls_default = arg
elif opt == '--tls_endpoint':
name, pemfile = arg.split(':', 1)
ctx = SSL.Context(SSL.SSLv23_METHOD)
ctx.use_privatekey_file(pemfile)
ctx.use_certificate_chain_file(pemfile)
self.tls_endpoints[name] = (pemfile, ctx)
elif opt in ('-D', '--dyndns'):
if arg.startswith('http'):
self.dyndns = (arg, {'user': '', 'pass': ''})
elif '@' in arg:
splits = arg.split('@')
provider = splits.pop()
usrpwd = '@'.join(splits)
if provider in DYNDNS: provider = DYNDNS[provider]
if ':' in usrpwd:
usr, pwd = usrpwd.split(':', 1)
self.dyndns = (provider, {'user': usr, 'pass': pwd})
else:
self.dyndns = (provider, {'user': usrpwd, 'pass': ''})
else:
if arg in DYNDNS: arg = DYNDNS[arg]
self.dyndns = (arg, {'user': '', 'pass': ''})
elif opt in ('-p', '--ports'): self.server_ports = [int(x) for x in arg.split(',')]
elif opt == '--portalias':
port, alias = arg.split(':')
self.server_portalias[int(port)] = int(alias)
self.server_aliasport[int(alias)] = int(port)
elif opt == '--protos': self.server_protos = [x.lower() for x in arg.split(',')]
elif opt == '--rawports':
self.server_raw_ports = [(x == VIRTUAL_PN and x or int(x)) for x in arg.split(',')]
elif opt in ('-h', '--host'): self.server_host = arg
elif opt in ('-A', '--authdomain'): self.auth_domain = arg
elif opt == '--authhelpurl': self.auth_help_url = arg
elif opt == '--motd': self.motd = arg
elif opt == '--noupgradeinfo': self.upgrade_info = []
elif opt == '--upgradeinfo':
version, tag, md5, human_url, file_url = arg.split(';')
self.upgrade_info.append((version, tag, md5, human_url, file_url))
elif opt in ('-f', '--isfrontend'):
self.isfrontend = True
global LOG_THRESHOLD
LOG_THRESHOLD *= 4
elif opt in ('-a', '--all'): self.require_all = True
elif opt in ('-N', '--new'): self.servers_new_only = True
elif opt in ('--socksify', '--torify'):
try:
import socks
(host, port) = arg.split(':')
socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5, host, int(port))
self.socks_server = (host, port)
# This increases the odds of unrelated requests getting lumped
# together in the tunnel, which makes traffic analysis harder.
global SEND_ALWAYS_BUFFERS
SEND_ALWAYS_BUFFERS = True
except Exception, e:
raise ConfigError("Please instally SocksiPy: "
" http://code.google.com/p/socksipy-branch/")
if opt == '--torify':
self.servers_new_only = True # Disable initial DNS lookups (leaks)
self.servers_no_ping = True # Disable front-end pings
self.crash_report_url = None # Disable crash reports
socks.wrapmodule(urllib) # Make DynDNS updates go via tor
elif opt == '--ca_certs': self.ca_certs = arg
elif opt == '--fe_certname': self.fe_certname.append(arg.lower())
elif opt == '--frontend': self.servers_manual.append(arg)
elif opt == '--frontends':
count, domain, port = arg.split(':')
self.servers_auto = (int(count), domain, int(port))
elif opt in ('--errorurl', '-E'): self.error_url = arg
elif opt == '--backend':
protos, domain, bhost, bport, secret = arg.split(':')
for proto in protos.split(','):
proto = proto.replace('/', '-')
if '-' in proto:
proto, port = proto.split('-')
bid = '%s-%d:%s' % (proto.lower(), int(port), domain.lower())
else:
port = ''
bid = '%s:%s' % (proto.lower(), domain.lower())
backend = '%s:%s' % (bhost.lower(), bport)
if bid in self.backends:
raise ConfigError("Same backend/domain defined twice: %s" % bid)
self.backends[bid] = (proto.lower(), port, domain.lower(),
backend, secret, BE_STATUS_UNKNOWN)
elif opt == '--domain':
protos, domain, secret = arg.split(':')
if protos in ('*', ''): protos = ','.join(self.server_protos)
for proto in protos.split(','):
bid = '%s:%s' % (proto, domain)
if bid in self.backends:
raise ConfigError("Same backend/domain defined twice: %s" % bid)
self.backends[bid] = (proto, None, domain, None, secret,
BE_STATUS_UNKNOWN)
elif opt == '--noprobes': self.no_probes = True
elif opt == '--nofrontend': self.isfrontend = False
elif opt == '--nodaemonize': self.daemonize = False
elif opt == '--noall': self.require_all = False
elif opt == '--nozchunks': self.disable_zchunks = True
elif opt == '--sslzlib': self.enable_sslzlib = True
elif opt == '--debugio':
global DEBUG_IO
DEBUG_IO = True
elif opt == '--buffers': self.buffer_max = int(arg)
elif opt == '--nocrashreport': self.crash_report_url = None
elif opt == '--clean': pass
elif opt == '--nopyopenssl': pass
elif opt == '--noloop': self.main_loop = False
elif opt == '--defaults':
self.dyndns = (DYNDNS['pagekite.net'], {'user': '', 'pass': ''})
self.servers_auto = (1, 'frontends.b5p.us', 443)
#self.fe_certname = ['frontends.b5p.us', 'b5p.us']
elif opt == '--settings':
self.PrintSettings()
sys.exit(0)
else:
self.HelpAndExit()
return self
def CheckConfig(self):
if not self.servers_manual and not self.servers_auto and not self.isfrontend:
if not self.servers:
raise ConfigError('Nothing to do! List some servers, or run me as one.')
return self
def CheckAllTunnels(self, conns):
missing = []
for backend in self.backends:
proto, domain = backend.split(':')
if not conns.Tunnel(proto, domain):
missing.append(domain)
if missing:
self.FallDown('No tunnel for %s' % missing, help=False)
def Ping(self, host, port):
if self.servers_no_ping: return 0
start = time.time()
try:
fd = rawsocket(socket.AF_INET, socket.SOCK_STREAM)
try:
fd.settimeout(2.0) # Missing in Python 2.2
except Exception:
fd.setblocking(1)
fd.connect((host, port))
fd.send('PING / HTTP/1.0\r\n\r\n')
fd.recv(1024)
fd.close()
except Exception, e:
LogDebug('Ping %s:%s failed: %s' % (host, port, e))
return 100000
elapsed = (time.time() - start)
LogDebug('Pinged %s:%s: %f' % (host, port, elapsed))
return elapsed
def GetHostIpAddr(self, host):
return socket.gethostbyname(host)
def GetHostDetails(self, host):
return socket.gethostbyname_ex(host)
def ChooseFrontEnds(self):
self.servers = []
self.servers_preferred = []
# Enable internal loopback
if self.isfrontend:
need_loopback = False
for be in self.backends.values():
if be[BE_BACKEND]:
need_loopback = True
if need_loopback:
self.servers.append(LOOPBACK_FE)
# Convert the hostnames into IP addresses...
for server in self.servers_manual:
(host, port) = server.split(':')
try:
ipaddr = self.GetHostIpAddr(host)
server = '%s:%s' % (ipaddr, port)
if server not in self.servers:
self.servers.append(server)
self.servers_preferred.append(ipaddr)
except Exception, e:
LogDebug('DNS lookup failed for %s' % host)
# Lookup and choose from the auto-list (and our old domain).
if self.servers_auto:
(count, domain, port) = self.servers_auto
# First, check for old addresses and always connect to those.
if not self.servers_new_only:
for bid in self.backends:
(proto, bdom) = bid.split(':')
try:
(hn, al, ips) = self.GetHostDetails(bdom)
for ip in ips:
server = '%s:%s' % (ip, port)
if server not in self.servers: self.servers.append(server)
except Exception, e:
LogDebug('DNS lookup failed for %s' % bdom)
try:
(hn, al, ips) = socket.gethostbyname_ex(domain)
times = [self.Ping(ip, port) for ip in ips]
except Exception, e:
LogDebug('Unreachable: %s, %s' % (domain, e))
ips = times = []
while count > 0 and ips:
count -= 1
mIdx = times.index(min(times))
server = '%s:%s' % (ips[mIdx], port)
if server not in self.servers:
self.servers.append(server)
if ips[mIdx] not in self.servers_preferred:
self.servers_preferred.append(ips[mIdx])
del times[mIdx]
del ips[mIdx]
def CreateTunnels(self, conns):
live_servers = conns.TunnelServers()
failures = 0
connections = 0
if self.backends:
if not self.servers or len(self.servers) > len(live_servers):
self.ChooseFrontEnds()
for server in self.servers:
if server not in live_servers:
if server == LOOPBACK_FE:
LoopbackTunnel.Loop(conns, self.backends)
else:
if Tunnel.BackEnd(server, self.backends, self.require_all, conns):
Log([('connect', server)])
connections += 1
else:
failures += 1
LogInfo('Failed to connect', [('FE', server)])
if self.dyndns:
updates = {}
ddns_fmt, ddns_args = self.dyndns
for bid in self.backends.keys():
proto, domain = bid.split(':')
if bid in conns.tunnels:
ips = []
bips = []
for tunnel in conns.tunnels[bid]:
ip = tunnel.server_info[tunnel.S_NAME].split(':')[0]
if not ip == LOOPBACK_HN:
if not self.servers_preferred or ip in self.servers_preferred:
ips.append(ip)
else:
bips.append(ip)
if not ips: ips = bips
if ips:
iplist = ','.join(ips)
payload = '%s:%s' % (domain, iplist)
args = {}
args.update(ddns_args)
args.update({
'domain': domain,
'ip': ips[0],
'ips': iplist,
'sign': signToken(secret=self.backends[bid][BE_SECRET],
payload=payload, length=100)
})
# FIXME: This may fail if different front-ends support different
# protocols. In practice, this should be rare.
update = ddns_fmt % args
if domain not in updates or len(update) < len(updates[domain]):
updates[payload] = update
last_updates = self.last_updates
self.last_updates = []
for update in updates:
if update not in last_updates:
try:
result = ''.join(urllib.urlopen(updates[update]).readlines())
self.last_updates.append(update)
if result.startswith('good') or result.startswith('nochg'):
Log([('dyndns', result), ('data', update)])
else:
LogInfo('DynDNS update failed: %s' % result, [('data', update)])
failures += 1
except Exception, e:
LogInfo('DynDNS update failed: %s' % e, [('data', update)])
failures += 1
if not self.last_updates:
self.last_updates = last_updates
return failures
def LogTo(self, filename, close_all=True, dont_close=[]):
global Log
if filename == 'memory':
Log = LogToMemory
filename = self.devnull
elif filename == 'syslog':
Log = LogSyslog
filename = self.devnull
syslog.openlog((sys.argv[0] or 'pagekite.py').split('/')[-1],
syslog.LOG_PID, syslog.LOG_DAEMON)
if filename != 'stdio':
global LogFile
try:
LogFile = fd = open(filename, "a", 0)
os.dup2(fd.fileno(), sys.stdin.fileno())
os.dup2(fd.fileno(), sys.stdout.fileno())
os.dup2(fd.fileno(), sys.stderr.fileno())
except Exception, e:
raise ConfigError('%s' % e)
def Daemonize(self):
# Fork once...
if os.fork() != 0: os._exit(0)
# Fork twice...
os.setsid()
if os.fork() != 0: os._exit(0)
def SelectLoop(self):
global buffered_bytes
conns = self.conns
last_loop = time.time()
self.looping = True
iready, oready, eready = None, None, None
while self.looping:
isocks, osocks = conns.Readable(), conns.Blocked()
try:
if isocks or osocks:
iready, oready, eready = select.select(isocks, osocks, [], 1.1)
else:
# Windoes does not seem to like empty selects, so we do this instead.
time.sleep(0.5)
except KeyboardInterrupt, e:
raise KeyboardInterrupt()
except Exception, e:
LogError('Error in select: %s (%s/%s)' % (e, isocks, osocks))
conns.CleanFds()
last_loop -= 1
now = time.time()
if not iready and not oready:
if (isocks or osocks) and (now < last_loop + 1):
LogError('Spinning, pausing ...')
time.sleep(0.1)
if oready:
for socket in oready:
conn = conns.Connection(socket)
if conn and not conn.Send([], try_flush=True):
# LogDebug("Write error in main loop, closing %s" % conn)
conns.Remove(conn)
conn.Cleanup()
if buffered_bytes < 1024 * self.buffer_max:
throttle = None
else:
LogDebug("FIXME: Nasty pause to let buffers clear!")
time.sleep(0.1)
throttle = 1024
if iready:
for socket in iready:
conn = conns.Connection(socket)
if conn and not conn.ReadData(maxread=throttle):
# LogDebug("Read error in main loop, closing %s" % conn)
conns.Remove(conn)
conn.Cleanup()
for conn in conns.DeadConns():
conns.Remove(conn)
conn.Cleanup()
last_loop = now
def Loop(self):
self.conns.start()
if self.ui_httpd: self.ui_httpd.start()
if self.tunnel_manager: self.tunnel_manager.start()
try:
epoll = select.epoll()
except Exception, msg:
epoll = None
if epoll: LogDebug("FIXME: Should try epoll!")
self.SelectLoop()
def Start(self):
conns = self.conns = Connections(self)
global Log
# Log that we've started up
config_report = [('started', sys.argv[0]), ('version', APPVER),
('argv', ' '.join(sys.argv[1:])),
('ca_certs', self.ca_certs)]
for optf in self.rcfiles_loaded: config_report.append(('optfile', optf))
Log(config_report)
try:
# Set up our listeners if we are a server.
if self.isfrontend:
for port in self.server_ports:
Listener(self.server_host, port, conns)
for port in self.server_raw_ports:
if port != VIRTUAL_PN and port > 0:
Listener(self.server_host, port, conns, connclass=RawConn)
# Start the UI thread
if self.ui_sspec:
self.ui_httpd = HttpUiThread(self, conns,
handler=self.ui_request_handler,
server=self.ui_http_server,
ssl_pem_filename = self.ui_pemfile)
# Create the Tunnel Manager
self.tunnel_manager = TunnelManager(self, conns)
except Exception, e:
Log = LogToFile
FlushLogMemory()
raise ConfigError(e)
# Create log-file
Log = LogToFile
if self.logfile:
keep_open = [s.fd.fileno() for s in conns.conns]
if self.ui_httpd: keep_open.append(self.ui_httpd.httpd.socket.fileno())
self.LogTo(self.logfile, dont_close=keep_open)
# Flush in-memory log, if necessary
FlushLogMemory()
# Set up SIGHUP handler.
if self.logfile or self.reloadfile:
try:
import signal
def reopen(x,y):
if self.logfile:
self.LogTo(self.logfile, close_all=False)
LogDebug('SIGHUP received, reopening: %s' % self.logfile)
if self.reloadfile:
self.ConfigureFromFile(self.reloadfile)
signal.signal(signal.SIGHUP, reopen)
except Exception:
LogError('Warning: signal handler unavailable, logrotate will not work.')
# Disable compression in OpenSSL
if not self.enable_sslzlib:
DisableSSLCompression()
# Daemonize!
if self.daemonize:
self.Daemonize()
# Create global secret
globalSecret()
# Create PID file
if self.pidfile:
pf = open(self.pidfile, 'w')
pf.write('%s\n' % os.getpid())
pf.close()
# Do this after creating the PID and log-files.
if self.daemonize: os.chdir('/')
# Drop privileges, if we have any.
if self.setgid: os.setgid(self.setgid)
if self.setuid: os.setuid(self.setuid)
if self.setuid or self.setgid:
Log([('uid', os.getuid()), ('gid', os.getgid())])
# Make sure we have what we need
if self.require_all:
self.CreateTunnels(conns)
self.CheckAllTunnels(conns)
# Finally, run our select/epoll loop.
self.Loop()
Log([('stopping', 'pagekite.py')])
if self.ui_httpd: self.ui_httpd.quit()
if self.tunnel_manager: self.tunnel_manager.quit()
if self.conns:
if self.conns.auth: self.conns.auth.quit()
for conn in self.conns.conns: conn.Cleanup()
##[ Main ]#####################################################################
def Main(pagekite, configure):
crashes = 1
while True:
pk = pagekite()
try:
try:
try:
configure(pk)
except Exception, e:
raise ConfigError(e)
pk.Start()
except (ConfigError, getopt.GetoptError), msg:
pk.FallDown(msg)
except KeyboardInterrupt, msg:
pk.FallDown(None, help=False, noexit=True)
return
except SystemExit:
sys.exit(0)
except Exception, msg:
traceback.print_exc(file=sys.stderr)
if pk.crash_report_url:
try:
print 'Submitting crash report to %s' % pk.crash_report_url
LogDebug(''.join(urllib.urlopen(pk.crash_report_url,
urllib.urlencode({
'crash': traceback.format_exc()
})).readlines()))
except Exception, e:
print 'FAILED: %s' % e
pk.FallDown(msg, help=False, noexit=pk.main_loop)
# If we get this far, then we're looping. Clean up.
sockets = pk.conns and pk.conns.Sockets() or []
for fd in sockets: fd.close()
# Exponential fall-back.
LogDebug('Restarting in %d seconds...' % (2 ** crashes))
time.sleep(2 ** crashes)
crashes += 1
if crashes > 9: crashes = 9
def Configure(pk):
if '--appver' in sys.argv:
print '%s' % APPVER
sys.exit(0)
if '--clean' not in sys.argv:
if os.path.exists(pk.rcfile): pk.ConfigureFromFile()
pk.Configure(sys.argv[1:])
pk.CheckConfig()
if __name__ == '__main__':
Main(PageKite, Configure)
# vi:ts=2 expandtab
pagekite-0.5.9.3/scripts/legacy-testing/pagekite-0.4.6a.py 0000755 0000000 0000000 00001152103 13232067545 023007 0 ustar root root 0000000 0000000 #!/usr/bin/python
#
# NOTE: This is a compilation of multiple Python files.
# See below for details on individual segments.
#
import base64, imp, os, sys, StringIO, zlib
__FILES = {}
__os_path_exists = os.path.exists
__builtin_open = open
def __comb_open(filename, *args, **kwargs):
if filename in __FILES:
return StringIO.StringIO(__FILES[filename])
else:
return __builtin_open(filename, *args, **kwargs)
def __comb_exists(filename, *args, **kwargs):
if filename in __FILES:
return True
else:
return __os_path_exists(filename, *args, **kwargs)
open = __comb_open
os.path.exists = __comb_exists
sys.path[0:0] = ['.SELF/']
###############################################################################
__FILES[".SELF/sockschain/__init__.py"] = """\
#!/usr/bin/python
\"\"\"SocksiPy - Python SOCKS module.
Version 2.00
Copyright 2011 Bjarni R. Einarsson. All rights reserved.
Copyright 2006 Dan-Haim. All rights reserved.
Redistribution and use in source and binary forms, with or without modification,
are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
3. Neither the name of Dan Haim nor the names of his contributors may be used
to endorse or promote products derived from this software without specific
prior written permission.
THIS SOFTWARE IS PROVIDED BY DAN HAIM \"AS IS\" AND ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
EVENT SHALL DAN HAIM OR HIS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA
OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMANGE.
This module provides a standard socket-like interface for Python
for tunneling connections through SOCKS proxies.
\"\"\"
\"\"\"
Refactored to allow proxy chaining and use as a command-line netcat-like
tool by Bjarni R. Einarsson (http://bre.klaki.net/) for use with PageKite
(http://pagekite.net/).
Minor modifications made by Christopher Gilbert (http://motomastyle.com/)
for use in PyLoris (http://pyloris.sourceforge.net/)
Minor modifications made by Mario Vilas (http://breakingcode.wordpress.com/)
mainly to merge bug fixes found in Sourceforge
\"\"\"
import base64, errno, os, socket, sys, select, struct, threading
DEBUG = False
#def DEBUG(foo): print foo
##[ SSL compatibility code ]##################################################
try:
import hashlib
def sha1hex(data):
hl = hashlib.sha1()
hl.update(data)
return hl.hexdigest().lower()
except ImportError:
import sha
def sha1hex(data):
return sha.new(data).hexdigest().lower()
def SSL_CheckName(commonName, digest, valid_names):
pairs = [(commonName, '%s/%s' % (commonName, digest))]
valid = 0
if commonName.startswith('*.'):
commonName = commonName[1:].lower()
for name in valid_names:
name = name.split('/')[0].lower()
if ('.'+name).endswith(commonName):
pairs.append((name, '%s/%s' % (name, digest)))
for commonName, cNameDigest in pairs:
if ((commonName in valid_names) or (cNameDigest in valid_names)):
valid += 1
if DEBUG: DEBUG(('*** Cert score: %s (%s ?= %s)'
) % (valid, pairs, valid_names))
return valid
HAVE_SSL = False
HAVE_PYOPENSSL = False
TLS_CA_CERTS = \"/etc/ssl/certs/ca-certificates.crt\"
try:
if '--nopyopenssl' in sys.argv or '--nossl' in sys.argv:
raise ImportError('pyOpenSSL disabled')
from OpenSSL import SSL
HAVE_SSL = HAVE_PYOPENSSL = True
def SSL_Connect(ctx, sock,
server_side=False, accepted=False, connected=False,
verify_names=None):
if DEBUG: DEBUG('*** TLS is provided by pyOpenSSL')
if verify_names:
def vcb(conn, x509, errno, depth, rc):
if errno != 0: return False
if depth != 0: return True
return (SSL_CheckName(x509.get_subject().commonName.lower(),
x509.digest('sha1').replace(':',''),
verify_names) > 0)
ctx.set_verify(SSL.VERIFY_PEER |
SSL.VERIFY_FAIL_IF_NO_PEER_CERT, vcb)
else:
def vcb(conn, x509, errno, depth, rc): return (errno == 0)
ctx.set_verify(SSL.VERIFY_NONE, vcb)
nsock = SSL.Connection(ctx, sock)
if accepted: nsock.set_accept_state()
if connected: nsock.set_connect_state()
if verify_names: nsock.do_handshake()
return nsock
except ImportError:
try:
if '--nossl' in sys.argv:
raise ImportError('SSL disabled')
import ssl
HAVE_SSL = True
class SSL(object):
SSLv23_METHOD = ssl.PROTOCOL_SSLv23
SSLv3_METHOD = ssl.PROTOCOL_SSLv3
TLSv1_METHOD = ssl.PROTOCOL_TLSv1
WantReadError = ssl.SSLError
class Error(Exception): pass
class SysCallError(Exception): pass
class WantWriteError(Exception): pass
class ZeroReturnError(Exception): pass
class Context(object):
def __init__(self, method):
self.method = method
self.privatekey_file = None
self.certchain_file = None
self.ca_certs = None
self.ciphers = None
def use_privatekey_file(self, fn):
self.privatekey_file = fn
def use_certificate_chain_file(self, fn):
self.certchain_file = fn
def set_cipher_list(self, ciphers):
self.ciphers = ciphers
def load_verify_locations(self, pemfile, capath=None):
self.ca_certs = pemfile
def SSL_CheckPeerName(fd, names):
cert = fd.getpeercert()
certhash = sha1hex(fd.getpeercert(binary_form=True))
if not cert: return None
valid = 0
for field in cert['subject']:
if field[0][0].lower() == 'commonname':
valid += SSL_CheckName(field[0][1].lower(), certhash, names)
if 'subjectAltName' in cert:
for field in cert['subjectAltName']:
if field[0].lower() == 'dns':
name = field[1].lower()
valid += SSL_CheckName(field[1].lower(),
certhash, names)
return (valid > 0)
def SSL_Connect(ctx, sock,
server_side=False, accepted=False, connected=False,
verify_names=None):
if DEBUG: DEBUG('*** TLS is provided by native Python ssl')
reqs = (verify_names and ssl.CERT_REQUIRED or ssl.CERT_NONE)
try:
fd = ssl.wrap_socket(sock, keyfile=ctx.privatekey_file,
certfile=ctx.certchain_file,
cert_reqs=reqs,
ca_certs=ctx.ca_certs,
do_handshake_on_connect=False,
ssl_version=ctx.method,
ciphers=ctx.ciphers,
server_side=server_side)
except:
fd = ssl.wrap_socket(sock, keyfile=ctx.privatekey_file,
certfile=ctx.certchain_file,
cert_reqs=reqs,
ca_certs=ctx.ca_certs,
do_handshake_on_connect=False,
ssl_version=ctx.method,
server_side=server_side)
if verify_names:
fd.do_handshake()
if not SSL_CheckPeerName(fd, verify_names):
raise SSL.Error(('Cert not in %s (%s)'
) % (verify_names, reqs))
return fd
except ImportError:
class SSL(object):
# Mock to let our try/except clauses below not fail.
class Error(Exception): pass
class SysCallError(Exception): pass
class WantWriteError(Exception): pass
class ZeroReturnError(Exception): pass
def DisableSSLCompression():
# Hack to disable compression in OpenSSL and reduce memory usage *lots*.
# Source:
# http://journal.paul.querna.org/articles/2011/04/05/openssl-memory-use/
try:
import ctypes
import glob
openssl = ctypes.CDLL(None, ctypes.RTLD_GLOBAL)
try:
f = openssl.SSL_COMP_get_compression_methods
except AttributeError:
ssllib = sorted(glob.glob(\"/usr/lib/libssl.so.*\"))[0]
openssl = ctypes.CDLL(ssllib, ctypes.RTLD_GLOBAL)
openssl.SSL_COMP_get_compression_methods.restype = ctypes.c_void_p
openssl.sk_zero.argtypes = [ctypes.c_void_p]
openssl.sk_zero(openssl.SSL_COMP_get_compression_methods())
except Exception:
if DEBUG: DEBUG('disableSSLCompression: Failed')
##[ SocksiPy itself ]#########################################################
PROXY_TYPE_DEFAULT = -1
PROXY_TYPE_NONE = 0
PROXY_TYPE_SOCKS4 = 1
PROXY_TYPE_SOCKS5 = 2
PROXY_TYPE_HTTP = 3
PROXY_TYPE_SSL = 4
PROXY_TYPE_SSL_WEAK = 5
PROXY_TYPE_SSL_ANON = 6
PROXY_TYPE_TOR = 7
PROXY_TYPE_HTTPS = 8
PROXY_TYPE_HTTP_CONNECT = 9
PROXY_TYPE_HTTPS_CONNECT = 10
PROXY_SSL_TYPES = (PROXY_TYPE_SSL, PROXY_TYPE_SSL_WEAK,
PROXY_TYPE_SSL_ANON, PROXY_TYPE_HTTPS,
PROXY_TYPE_HTTPS_CONNECT)
PROXY_HTTP_TYPES = (PROXY_TYPE_HTTP, PROXY_TYPE_HTTPS)
PROXY_HTTPC_TYPES = (PROXY_TYPE_HTTP_CONNECT, PROXY_TYPE_HTTPS_CONNECT)
PROXY_SOCKS5_TYPES = (PROXY_TYPE_SOCKS5, PROXY_TYPE_TOR)
PROXY_DEFAULTS = {
PROXY_TYPE_NONE: 0,
PROXY_TYPE_DEFAULT: 0,
PROXY_TYPE_HTTP: 8080,
PROXY_TYPE_HTTP_CONNECT: 8080,
PROXY_TYPE_SOCKS4: 1080,
PROXY_TYPE_SOCKS5: 1080,
PROXY_TYPE_TOR: 9050,
}
PROXY_TYPES = {
'none': PROXY_TYPE_NONE,
'default': PROXY_TYPE_DEFAULT,
'defaults': PROXY_TYPE_DEFAULT,
'http': PROXY_TYPE_HTTP,
'httpc': PROXY_TYPE_HTTP_CONNECT,
'socks': PROXY_TYPE_SOCKS5,
'socks4': PROXY_TYPE_SOCKS4,
'socks4a': PROXY_TYPE_SOCKS4,
'socks5': PROXY_TYPE_SOCKS5,
'tor': PROXY_TYPE_TOR,
}
if HAVE_SSL:
PROXY_DEFAULTS.update({
PROXY_TYPE_HTTPS: 443,
PROXY_TYPE_HTTPS_CONNECT: 443,
PROXY_TYPE_SSL: 443,
PROXY_TYPE_SSL_WEAK: 443,
PROXY_TYPE_SSL_ANON: 443,
})
PROXY_TYPES.update({
'https': PROXY_TYPE_HTTPS,
'httpcs': PROXY_TYPE_HTTPS_CONNECT,
'ssl': PROXY_TYPE_SSL,
'ssl-anon': PROXY_TYPE_SSL_ANON,
'ssl-weak': PROXY_TYPE_SSL_WEAK,
})
P_TYPE = 0
P_HOST = 1
P_PORT = 2
P_RDNS = 3
P_USER = 4
P_PASS = P_CACERTS = 5
P_CERTS = 6
DEFAULT_ROUTE = '*'
_proxyroutes = { }
_orgsocket = socket.socket
_orgcreateconn = getattr(socket, 'create_connection', None)
try:
_thread_locals = threading.local()
def _thread_local(): return _thread_locals
except AttributeError:
# Pre 2.4, we have to implement our own.
_thread_local_dict = {}
class Storage(object): pass
def _thread_local():
tid = str(threading.currentThread())
if not tid in _thread_local_dict: _thread_local_dict[tid] = Storage()
return _thread_local_dict[tid]
class ProxyError(Exception): pass
class GeneralProxyError(ProxyError): pass
class Socks5AuthError(ProxyError): pass
class Socks5Error(ProxyError): pass
class Socks4Error(ProxyError): pass
class HTTPError(ProxyError): pass
_generalerrors = (\"success\",
\"invalid data\",
\"not connected\",
\"not available\",
\"bad proxy type\",
\"bad input\")
_socks5errors = (\"succeeded\",
\"general SOCKS server failure\",
\"connection not allowed by ruleset\",
\"Network unreachable\",
\"Host unreachable\",
\"Connection refused\",
\"TTL expired\",
\"Command not supported\",
\"Address type not supported\",
\"Unknown error\")
_socks5autherrors = (\"succeeded\",
\"authentication is required\",
\"all offered authentication methods were rejected\",
\"unknown username or invalid password\",
\"unknown error\")
_socks4errors = (\"request granted\",
\"request rejected or failed\",
\"request rejected because SOCKS server cannot connect to identd on the client\",
\"request rejected because the client program and identd report different user-ids\",
\"unknown error\")
def parseproxy(arg):
# This silly function will do a quick-and-dirty parse of our argument
# into a proxy specification array. It lets people omit stuff.
args = arg.replace('/', '').split(':')
args[0] = PROXY_TYPES[args[0] or 'http']
if (len(args) in (3, 4, 5)) and ('@' in args[2]):
# Re-order http://user:pass@host:port/ => http:host:port:user:pass
pwd, host = args[2].split('@')
user = args[1]
args[1:3] = [host]
if len(args) == 2: args.append(PROXY_DEFAULTS[args[0]])
if len(args) == 3: args.append(False)
args.extend([user, pwd])
elif (len(args) in (2, 3, 4)) and ('@' in args[1]):
user, host = args[1].split('@')
args[1] = host
if len(args) == 2: args.append(PROXY_DEFAULTS[args[0]])
if len(args) == 3: args.append(False)
args.append(user)
if len(args) == 2: args.append(PROXY_DEFAULTS[args[0]])
if len(args) > 2: args[2] = int(args[2])
if args[P_TYPE] in PROXY_SSL_TYPES:
names = (args[P_HOST] or '').split(',')
args[P_HOST] = names[0]
while len(args) <= P_CERTS:
args.append((len(args) == P_RDNS) and True or None)
args[P_CERTS] = (len(names) > 1) and names[1:] or names
return args
def addproxy(dest, proxytype=None, addr=None, port=None, rdns=True,
username=None, password=None, certnames=None):
global _proxyroutes
route = _proxyroutes.get(dest.lower(), None)
proxy = (proxytype, addr, port, rdns, username, password, certnames)
if route is None:
route = _proxyroutes.get(DEFAULT_ROUTE, [])[:]
route.append(proxy)
_proxyroutes[dest.lower()] = route
if DEBUG: DEBUG('Routes are: %s' % (_proxyroutes, ))
def setproxy(dest, *args, **kwargs):
global _proxyroutes
dest = dest.lower()
if args:
_proxyroutes[dest] = []
return addproxy(dest, *args, **kwargs)
else:
if dest in _proxyroutes:
del _proxyroutes[dest.lower()]
def setdefaultcertfile(path):
global TLS_CA_CERTS
TLS_CA_CERTS = path
def setdefaultproxy(*args, **kwargs):
\"\"\"setdefaultproxy(proxytype, addr[, port[, rdns[, username[, password[, certnames]]]]])
Sets a default proxy which all further socksocket objects will use,
unless explicitly changed.
\"\"\"
if args and args[P_TYPE] == PROXY_TYPE_DEFAULT:
raise ValueError(\"Circular reference to default proxy.\")
return setproxy(DEFAULT_ROUTE, *args, **kwargs)
def adddefaultproxy(*args, **kwargs):
if args and args[P_TYPE] == PROXY_TYPE_DEFAULT:
raise ValueError(\"Circular reference to default proxy.\")
return addproxy(DEFAULT_ROUTE, *args, **kwargs)
def usesystemdefaults():
import os
no_proxy = ['localhost', 'localhost.localdomain', '127.0.0.1']
no_proxy.extend(os.environ.get('NO_PROXY',
os.environ.get('NO_PROXY',
'')).split(','))
for host in no_proxy:
setproxy(host, PROXY_TYPE_NONE)
for var in ('ALL_PROXY', 'HTTPS_PROXY', 'http_proxy'):
val = os.environ.get(var.lower(), os.environ.get(var, None))
if val:
setdefaultproxy(*parseproxy(val))
os.environ[var] = ''
return
def sockcreateconn(*args, **kwargs):
_thread_local().create_conn = args[0]
try:
rv = _orgcreateconn(*args, **kwargs)
return rv
finally:
del(_thread_local().create_conn)
class socksocket(socket.socket):
\"\"\"socksocket([family[, type[, proto]]]) -> socket object
Open a SOCKS enabled socket. The parameters are the same as
those of the standard socket init. In order for SOCKS to work,
you must specify family=AF_INET, type=SOCK_STREAM and proto=0.
\"\"\"
def __init__(self, family=socket.AF_INET, type=socket.SOCK_STREAM, proto=0):
self.__sock = _orgsocket(family, type, proto)
self.__proxy = None
self.__proxysockname = None
self.__proxypeername = None
self.__makefile_refs = 0
self.__buffer = ''
self.__negotiating = False
self.__override = ['addproxy', 'setproxy',
'getproxysockname', 'getproxypeername',
'close', 'connect', 'getpeername', 'makefile',
'recv'] #, 'send', 'sendall']
def __getattribute__(self, name):
if name.startswith('_socksocket__'):
return object.__getattribute__(self, name)
elif name in self.__override:
return object.__getattribute__(self, name)
else:
return getattr(object.__getattribute__(self, \"_socksocket__sock\"),
name)
def __setattr__(self, name, value):
if name.startswith('_socksocket__'):
return object.__setattr__(self, name, value)
else:
return setattr(object.__getattribute__(self, \"_socksocket__sock\"),
name, value)
def __recvall(self, count):
\"\"\"__recvall(count) -> data
Receive EXACTLY the number of bytes requested from the socket.
Blocks until the required number of bytes have been received or a
timeout occurs.
\"\"\"
self.__sock.setblocking(1)
try:
self.__sock.settimeout(20)
except:
# Python 2.2 compatibility hacks.
pass
data = self.recv(count)
while len(data) < count:
d = self.recv(count-len(data))
if d == '':
raise GeneralProxyError((0, \"connection closed unexpectedly\"))
data = data + d
return data
def close(self):
if self.__makefile_refs < 1:
self.__sock.close()
else:
self.__makefile_refs -= 1
def makefile(self, mode='r', bufsize=-1):
self.__makefile_refs += 1
try:
return socket._fileobject(self, mode, bufsize, close=True)
except TypeError:
# Python 2.2 compatibility hacks.
return socket._fileobject(self, mode, bufsize)
def addproxy(self, proxytype=None, addr=None, port=None, rdns=True, username=None, password=None, certnames=None):
\"\"\"setproxy(proxytype, addr[, port[, rdns[, username[, password[, certnames]]]]])
Sets the proxy to be used.
proxytype - The type of the proxy to be used. Three types
are supported: PROXY_TYPE_SOCKS4 (including socks4a),
PROXY_TYPE_SOCKS5 and PROXY_TYPE_HTTP
addr - The address of the server (IP or DNS).
port - The port of the server. Defaults to 1080 for SOCKS
servers and 8080 for HTTP proxy servers.
rdns - Should DNS queries be preformed on the remote side
(rather than the local side). The default is True.
Note: This has no effect with SOCKS4 servers.
username - Username to authenticate with to the server.
The default is no authentication.
password - Password to authenticate with to the server.
Only relevant when username is also provided.
\"\"\"
proxy = (proxytype, addr, port, rdns, username, password, certnames)
if not self.__proxy: self.__proxy = []
self.__proxy.append(proxy)
def setproxy(self, *args, **kwargs):
\"\"\"setproxy(proxytype, addr[, port[, rdns[, username[, password[, certnames]]]]])
(see addproxy)
\"\"\"
self.__proxy = []
self.addproxy(*args, **kwargs)
def __negotiatesocks5(self, destaddr, destport, proxy):
\"\"\"__negotiatesocks5(self, destaddr, destport, proxy)
Negotiates a connection through a SOCKS5 server.
\"\"\"
# First we'll send the authentication packages we support.
if (proxy[P_USER]!=None) and (proxy[P_PASS]!=None):
# The username/password details were supplied to the
# setproxy method so we support the USERNAME/PASSWORD
# authentication (in addition to the standard none).
self.sendall(struct.pack('BBBB', 0x05, 0x02, 0x00, 0x02))
else:
# No username/password were entered, therefore we
# only support connections with no authentication.
self.sendall(struct.pack('BBB', 0x05, 0x01, 0x00))
# We'll receive the server's response to determine which
# method was selected
chosenauth = self.__recvall(2)
if chosenauth[0:1] != chr(0x05).encode():
self.close()
raise GeneralProxyError((1, _generalerrors[1]))
# Check the chosen authentication method
if chosenauth[1:2] == chr(0x00).encode():
# No authentication is required
pass
elif chosenauth[1:2] == chr(0x02).encode():
# Okay, we need to perform a basic username/password
# authentication.
self.sendall(chr(0x01).encode() +
chr(len(proxy[P_USER])) + proxy[P_USER] +
chr(len(proxy[P_PASS])) + proxy[P_PASS])
authstat = self.__recvall(2)
if authstat[0:1] != chr(0x01).encode():
# Bad response
self.close()
raise GeneralProxyError((1, _generalerrors[1]))
if authstat[1:2] != chr(0x00).encode():
# Authentication failed
self.close()
raise Socks5AuthError((3, _socks5autherrors[3]))
# Authentication succeeded
else:
# Reaching here is always bad
self.close()
if chosenauth[1] == chr(0xFF).encode():
raise Socks5AuthError((2, _socks5autherrors[2]))
else:
raise GeneralProxyError((1, _generalerrors[1]))
# Now we can request the actual connection
req = struct.pack('BBB', 0x05, 0x01, 0x00)
# If the given destination address is an IP address, we'll
# use the IPv4 address request even if remote resolving was specified.
try:
ipaddr = socket.inet_aton(destaddr)
req = req + chr(0x01).encode() + ipaddr
except socket.error:
# Well it's not an IP number, so it's probably a DNS name.
if proxy[P_RDNS]:
# Resolve remotely
ipaddr = None
req = req + (chr(0x03).encode() +
chr(len(destaddr)).encode() + destaddr)
else:
# Resolve locally
ipaddr = socket.inet_aton(socket.gethostbyname(destaddr))
req = req + chr(0x01).encode() + ipaddr
req = req + struct.pack(\">H\", destport)
self.sendall(req)
# Get the response
resp = self.__recvall(4)
if resp[0:1] != chr(0x05).encode():
self.close()
raise GeneralProxyError((1, _generalerrors[1]))
elif resp[1:2] != chr(0x00).encode():
# Connection failed
self.close()
if ord(resp[1:2])<=8:
raise Socks5Error((ord(resp[1:2]),
_socks5errors[ord(resp[1:2])]))
else:
raise Socks5Error((9, _socks5errors[9]))
# Get the bound address/port
elif resp[3:4] == chr(0x01).encode():
boundaddr = self.__recvall(4)
elif resp[3:4] == chr(0x03).encode():
resp = resp + self.recv(1)
boundaddr = self.__recvall(ord(resp[4:5]))
else:
self.close()
raise GeneralProxyError((1,_generalerrors[1]))
boundport = struct.unpack(\">H\", self.__recvall(2))[0]
self.__proxysockname = (boundaddr, boundport)
if ipaddr != None:
self.__proxypeername = (socket.inet_ntoa(ipaddr), destport)
else:
self.__proxypeername = (destaddr, destport)
def getproxysockname(self):
\"\"\"getsockname() -> address info
Returns the bound IP address and port number at the proxy.
\"\"\"
return self.__proxysockname
def getproxypeername(self):
\"\"\"getproxypeername() -> address info
Returns the IP and port number of the proxy.
\"\"\"
return _orgsocket.getpeername(self)
def getpeername(self):
\"\"\"getpeername() -> address info
Returns the IP address and port number of the destination
machine (note: getproxypeername returns the proxy)
\"\"\"
return self.__proxypeername
def __negotiatesocks4(self, destaddr, destport, proxy):
\"\"\"__negotiatesocks4(self, destaddr, destport, proxy)
Negotiates a connection through a SOCKS4 server.
\"\"\"
# Check if the destination address provided is an IP address
rmtrslv = False
try:
ipaddr = socket.inet_aton(destaddr)
except socket.error:
# It's a DNS name. Check where it should be resolved.
if proxy[P_RDNS]:
ipaddr = struct.pack(\"BBBB\", 0x00, 0x00, 0x00, 0x01)
rmtrslv = True
else:
ipaddr = socket.inet_aton(socket.gethostbyname(destaddr))
# Construct the request packet
req = struct.pack(\">BBH\", 0x04, 0x01, destport) + ipaddr
# The username parameter is considered userid for SOCKS4
if proxy[P_USER] != None:
req = req + proxy[P_USER]
req = req + chr(0x00).encode()
# DNS name if remote resolving is required
# NOTE: This is actually an extension to the SOCKS4 protocol
# called SOCKS4A and may not be supported in all cases.
if rmtrslv:
req = req + destaddr + chr(0x00).encode()
self.sendall(req)
# Get the response from the server
resp = self.__recvall(8)
if resp[0:1] != chr(0x00).encode():
# Bad data
self.close()
raise GeneralProxyError((1,_generalerrors[1]))
if resp[1:2] != chr(0x5A).encode():
# Server returned an error
self.close()
if ord(resp[1:2]) in (91, 92, 93):
self.close()
raise Socks4Error((ord(resp[1:2]), _socks4errors[ord(resp[1:2]) - 90]))
else:
raise Socks4Error((94, _socks4errors[4]))
# Get the bound address/port
self.__proxysockname = (socket.inet_ntoa(resp[4:]),
struct.unpack(\">H\", resp[2:4])[0])
if rmtrslv != None:
self.__proxypeername = (socket.inet_ntoa(ipaddr), destport)
else:
self.__proxypeername = (destaddr, destport)
def __getproxyauthheader(self, proxy):
if proxy[P_USER] and proxy[P_PASS]:
auth = proxy[P_USER] + \":\" + proxy[P_PASS]
return \"Proxy-Authorization: Basic %s\\r\\n\" % base64.b64encode(auth)
else:
return \"\"
def __stop_http_negotiation(self):
buf = self.__buffer
host, port, proxy = self.__negotiating
self.__buffer = self.__negotiating = None
self.__override.remove('send')
self.__override.remove('sendall')
return (buf, host, port, proxy)
def recv(self, count):
if self.__negotiating:
# If the calling code tries to read before negotiating is done,
# assume this is not HTTP, bail and attempt HTTP CONNECT.
if DEBUG: DEBUG(\"*** Not HTTP, failing back to HTTP CONNECT.\")
buf, host, port, proxy = self.__stop_http_negotiation()
self.__negotiatehttpconnect(host, port, proxy)
self.__sock.sendall(buf)
while True:
try:
return self.__sock.recv(count)
except SSL.SysCallError:
return ''
except SSL.WantReadError:
pass
def send(self, *args, **kwargs):
if self.__negotiating:
self.__buffer += args[0]
self.__negotiatehttpproxy()
else:
return self.__sock.send(*args, **kwargs)
def sendall(self, *args, **kwargs):
if self.__negotiating:
self.__buffer += args[0]
self.__negotiatehttpproxy()
else:
return self.__sock.sendall(*args, **kwargs)
def __negotiatehttp(self, destaddr, destport, proxy):
\"\"\"__negotiatehttpproxy(self, destaddr, destport, proxy)
Negotiates a connection through an HTTP proxy server.
\"\"\"
if destport in (21, 22, 23, 25, 109, 110, 143, 220, 443, 993, 995):
# Go straight to HTTP CONNECT for anything related to e-mail,
# SSH, telnet, FTP, SSL, ...
self.__negotiatehttpconnect(destaddr, destport, proxy)
else:
if DEBUG: DEBUG('*** Transparent HTTP proxy mode...')
self.__negotiating = (destaddr, destport, proxy)
self.__override.extend(['send', 'sendall'])
def __negotiatehttpproxy(self):
\"\"\"__negotiatehttp(self, destaddr, destport, proxy)
Negotiates an HTTP request through an HTTP proxy server.
\"\"\"
buf = self.__buffer
host, port, proxy = self.__negotiating
# If our buffer is tiny, wait for data.
if len(buf) <= 3: return
# If not HTTP, fall back to HTTP CONNECT.
if buf[0:3].lower() not in ('get', 'pos', 'hea',
'put', 'del', 'opt', 'pro'):
if DEBUG: DEBUG(\"*** Not HTTP, failing back to HTTP CONNECT.\")
self.__stop_http_negotiation()
self.__negotiatehttpconnect(host, port, proxy)
self.__sock.sendall(buf)
return
# Have we got the end of the headers?
if buf.find('\\r\\n\\r\\n'.encode()) != -1:
CRLF = '\\r\\n'
elif buf.find('\\n\\n'.encode()) != -1:
CRLF = '\\n'
else:
# Nope
return
# Remove our send/sendall hooks.
self.__stop_http_negotiation()
# Format the proxy request.
host += ':%d' % port
headers = buf.split(CRLF)
for hdr in headers:
if hdr.lower().startswith('host: '): host = hdr[6:]
req = headers[0].split(' ', 1)
headers[0] = '%s http://%s%s' % (req[0], host, req[1])
headers[1] = self.__getproxyauthheader(proxy) + headers[1]
# Send it!
if DEBUG: DEBUG(\"*** Proxy request:\\n%s***\" % CRLF.join(headers))
self.__sock.sendall(CRLF.join(headers).encode())
def __negotiatehttpconnect(self, destaddr, destport, proxy):
\"\"\"__negotiatehttp(self, destaddr, destport, proxy)
Negotiates an HTTP CONNECT through an HTTP proxy server.
\"\"\"
# If we need to resolve locally, we do this now
if not proxy[P_RDNS]:
addr = socket.gethostbyname(destaddr)
else:
addr = destaddr
self.__sock.sendall((\"CONNECT \"
+ addr + \":\" + str(destport) + \" HTTP/1.1\\r\\n\"
+ self.__getproxyauthheader(proxy)
+ \"Host: \" + destaddr + \"\\r\\n\\r\\n\"
).encode())
# We read the response until we get \"\\r\\n\\r\\n\" or \"\\n\\n\"
resp = self.__recvall(1)
while (resp.find(\"\\r\\n\\r\\n\".encode()) == -1 and
resp.find(\"\\n\\n\".encode()) == -1):
resp = resp + self.__recvall(1)
# We just need the first line to check if the connection
# was successful
statusline = resp.splitlines()[0].split(\" \".encode(), 2)
if statusline[0] not in (\"HTTP/1.0\".encode(), \"HTTP/1.1\".encode()):
self.close()
raise GeneralProxyError((1, _generalerrors[1]))
try:
statuscode = int(statusline[1])
except ValueError:
self.close()
raise GeneralProxyError((1, _generalerrors[1]))
if statuscode != 200:
self.close()
raise HTTPError((statuscode, statusline[2]))
self.__proxysockname = (\"0.0.0.0\", 0)
self.__proxypeername = (addr, destport)
def __get_ca_ciphers(self):
return 'HIGH:MEDIUM:!MD5'
def __get_ca_anon_ciphers(self):
return 'aNULL'
def __get_ca_certs(self):
return TLS_CA_CERTS
def __negotiatessl(self, destaddr, destport, proxy,
weak=False, anonymous=False):
\"\"\"__negotiatessl(self, destaddr, destport, proxy)
Negotiates an SSL session.
\"\"\"
ssl_version = SSL.SSLv3_METHOD
want_hosts = ca_certs = self_cert = None
ciphers = self.__get_ca_ciphers()
if anonymous:
# Insecure and use anon ciphers - this is just camoflage
ciphers = self.__get_ca_anon_ciphers()
elif not weak:
# This is normal, secure mode.
self_cert = proxy[P_USER] or None
ca_certs = proxy[P_CACERTS] or self.__get_ca_certs() or None
want_hosts = proxy[P_CERTS] or [proxy[P_HOST]]
try:
ctx = SSL.Context(ssl_version)
ctx.set_cipher_list(ciphers)
if self_cert:
ctx.use_certificate_chain_file(self_cert)
ctx.use_privatekey_file(self_cert)
if ca_certs and want_hosts:
ctx.load_verify_locations(ca_certs)
self.__sock.setblocking(1)
self.__sock = SSL_Connect(ctx, self.__sock,
connected=True, verify_names=want_hosts)
except:
if DEBUG: DEBUG('*** SSL problem: %s/%s/%s' % (sys.exc_info(),
self.__sock,
want_hosts))
raise
self.__encrypted = True
if DEBUG: DEBUG('*** Wrapped %s:%s in %s' % (destaddr, destport,
self.__sock))
def __default_route(self, dest):
route = _proxyroutes.get(str(dest).lower(), [])[:]
if not route or route[0][P_TYPE] == PROXY_TYPE_DEFAULT:
route[0:1] = _proxyroutes.get(DEFAULT_ROUTE, [])
while route and route[0][P_TYPE] == PROXY_TYPE_DEFAULT:
route.pop(0)
return route
def connect(self, destpair):
\"\"\"connect(self, despair)
Connects to the specified destination through a chain of proxies.
destpar - A tuple of the IP/DNS address and the port number.
(identical to socket's connect).
To select the proxy servers use setproxy() and chainproxy().
\"\"\"
if DEBUG: DEBUG('*** Connect: %s / %s' % (destpair, self.__proxy))
destpair = getattr(_thread_local(), 'create_conn', destpair)
# Do a minimal input check first
if ((not type(destpair) in (list, tuple)) or
(len(destpair) < 2) or (type(destpair[0]) != type('')) or
(type(destpair[1]) != int)):
raise GeneralProxyError((5, _generalerrors[5]))
if self.__proxy:
proxy_chain = self.__proxy
default_dest = destpair[0]
else:
proxy_chain = self.__default_route(destpair[0])
default_dest = DEFAULT_ROUTE
for proxy in proxy_chain:
if (proxy[P_TYPE] or PROXY_TYPE_NONE) not in PROXY_DEFAULTS:
raise GeneralProxyError((4, _generalerrors[4]))
chain = proxy_chain[:]
chain.append([PROXY_TYPE_NONE, destpair[0], destpair[1]])
if DEBUG: DEBUG('*** Chain: %s' % (chain, ))
first = True
result = None
while chain:
proxy = chain.pop(0)
if proxy[P_TYPE] == PROXY_TYPE_DEFAULT:
chain[0:0] = self.__default_route(default_dest)
if DEBUG: DEBUG('*** Chain: %s' % chain)
continue
if proxy[P_PORT] != None:
portnum = proxy[P_PORT]
else:
portnum = PROXY_DEFAULTS[proxy[P_TYPE] or PROXY_TYPE_NONE]
if first and proxy[P_HOST]:
if DEBUG: DEBUG('*** Connect: %s:%s' % (proxy[P_HOST], portnum))
result = self.__sock.connect((proxy[P_HOST], portnum))
if chain:
nexthop = (chain[0][P_HOST] or '', int(chain[0][P_PORT] or 0))
if proxy[P_TYPE] in PROXY_SSL_TYPES:
if DEBUG: DEBUG('*** TLS/SSL Setup: %s' % (nexthop, ))
self.__negotiatessl(nexthop[0], nexthop[1], proxy,
weak=(proxy[P_TYPE] == PROXY_TYPE_SSL_WEAK),
anonymous=(proxy[P_TYPE] == PROXY_TYPE_SSL_ANON))
if proxy[P_TYPE] in PROXY_HTTPC_TYPES:
if DEBUG: DEBUG('*** HTTP CONNECT: %s' % (nexthop, ))
self.__negotiatehttpconnect(nexthop[0], nexthop[1], proxy)
elif proxy[P_TYPE] in PROXY_HTTP_TYPES:
if len(chain) > 1:
# Chaining requires HTTP CONNECT.
if DEBUG: DEBUG('*** HTTP CONNECT: %s' % (nexthop, ))
self.__negotiatehttpconnect(nexthop[0], nexthop[1],
proxy)
else:
# If we are last in the chain, do transparent magic.
if DEBUG: DEBUG('*** HTTP PROXY: %s' % (nexthop, ))
self.__negotiatehttp(nexthop[0], nexthop[1], proxy)
if proxy[P_TYPE] in PROXY_SOCKS5_TYPES:
if DEBUG: DEBUG('*** SOCKS5: %s' % (nexthop, ))
self.__negotiatesocks5(nexthop[0], nexthop[1], proxy)
elif proxy[P_TYPE] == PROXY_TYPE_SOCKS4:
if DEBUG: DEBUG('*** SOCKS4: %s' % (nexthop, ))
self.__negotiatesocks4(nexthop[0], nexthop[1], proxy)
elif proxy[P_TYPE] == PROXY_TYPE_NONE:
if first and nexthop[0] and nexthop[1]:
if DEBUG: DEBUG('*** Connect: %s:%s' % nexthop)
result = self.__sock.connect(nexthop)
else:
raise GeneralProxyError((4, _generalerrors[4]))
first = False
if DEBUG: DEBUG('*** Connected! (%s)' % result)
return result
def wrapmodule(module):
\"\"\"wrapmodule(module)
Attempts to replace a module's socket library with a SOCKS socket.
This will only work on modules that import socket directly into the
namespace; most of the Python Standard Library falls into this category.
\"\"\"
module.socket.socket = socksocket
module.socket.create_connection = sockcreateconn
## Netcat-like proxy-chaining tools follow ##
def netcat(s, i, o, keep_open=''):
if hasattr(o, 'buffer'): o = o.buffer
try:
in_fileno = i.fileno()
isel = [s, i]
obuf, sbuf, oselo, osels = [], [], [], []
while isel:
in_r, out_r, err_r = select.select(isel, oselo+osels, isel, 1000)
# print 'In:%s Out:%s Err:%s' % (in_r, out_r, err_r)
if s in in_r:
obuf.append(s.recv(4096))
oselo = [o]
if len(obuf[-1]) == 0:
if DEBUG: DEBUG('EOF(s, in)')
isel.remove(s)
if o in out_r:
o.write(obuf[0])
if len(obuf) == 1:
if len(obuf[0]) == 0:
if DEBUG: DEBUG('CLOSE(o)')
o.close()
if i in isel and 'i' not in keep_open:
isel.remove(i)
i.close()
else:
o.flush()
obuf, oselo = [], []
else:
obuf.pop(0)
if i in in_r:
sbuf.append(os.read(in_fileno, 4096))
osels = [s]
if len(sbuf[-1]) == 0:
if DEBUG: DEBUG('EOF(i)')
isel.remove(i)
if s in out_r:
s.send(sbuf[0])
if len(sbuf) == 1:
if len(sbuf[0]) == 0:
if s in isel and 's' not in keep_open:
if DEBUG: DEBUG('CLOSE(s)')
isel.remove(s)
s.close()
else:
if DEBUG: DEBUG('SHUTDOWN(s, WR)')
s.shutdown(socket.SHUT_WR)
sbuf, osels = [], []
else:
sbuf.pop(0)
for data in sbuf: s.sendall(data)
for data in obuf: o.write(data)
except:
if DEBUG: DEBUG(\"Disconnected: %s\" % (sys.exc_info(), ))
i.close()
s.close()
o.close()
def __proxy_connect_netcat(hostname, port, chain, keep_open):
try:
s = socksocket(socket.AF_INET, socket.SOCK_STREAM)
for proxy in chain:
s.addproxy(*proxy)
s.connect((hostname, port))
except:
sys.stderr.write('Error: %s\\n' % (sys.exc_info(), ))
return False
netcat(s, sys.stdin, sys.stdout, keep_open)
return True
def __make_proxy_chain(args):
chain = []
for arg in args:
chain.append(parseproxy(arg))
return chain
def DebugPrint(text):
print(text)
def Main():
keep_open = 's'
try:
args = sys.argv[1:]
if '--wait' in args:
keep_open = 'si'
args.remove('--wait')
if '--nowait' in args:
keep_open = ''
args.remove('--nowait')
if '--debug' in args:
global DEBUG
DEBUG = DebugPrint
args.remove('--debug')
for arg in ('--nopyopenssl', '--nossl'):
while arg in args:
args.remove(arg)
usesystemdefaults()
dest_host, dest_port = args.pop().split(':', 1)
dest_port = int(dest_port)
chain = __make_proxy_chain(args)
except:
DebugPrint('Error: %s' % (sys.exc_info(), ))
sys.stderr.write(('Usage: %s '
'[ [ ...]] '
'\\n') % os.path.basename(sys.argv[0]))
sys.exit(1)
try:
if not __proxy_connect_netcat(dest_host, dest_port, chain, keep_open):
sys.exit(2)
except KeyboardInterrupt:
sys.exit(0)
if __name__ == \"__main__\":
Main()
"""
sys.modules["sockschain"] = imp.new_module("sockschain")
sys.modules["sockschain"].open = __comb_open
exec __FILES[".SELF/sockschain/__init__.py"] in sys.modules["sockschain"].__dict__
###############################################################################
__FILES[".SELF/pagekite/__init__.py"] = """\
#!/usr/bin/python -u
LICENSE = \"\"\"\\
pagekite.py, Copyright 2010, 2011, the Beanstalks Project ehf.
and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
\"\"\"
##[ Maybe TODO: ]##############################################################
#
# Optimization:
# - Implement epoll() support.
# - Stress test this thing: when do we need a C rewrite?
# - Make multi-process, use the FD-over-socket trick? Threads=>GIL=>bleh
# - Add QoS and bandwidth shaping
# - Add a scheduler for deferred/periodic processing.
# - Replace string concatenation ops with lists of buffers.
#
# Protocols:
# - Make tunnel creation more stubborn (try multiple ports etc.)
# - Add XMPP and incoming SMTP support.
# - Replace/augment current tunnel auth scheme with SSL certificates.
#
# User interface:
# - Enable (re)configuration from within HTTP UI.
# - More human readable console output?
#
# Bugs?
# - Front-ends should time-out dead back-ends.
# - Gzip-related memory issues.
#
#
##[ Hacking guide! ]###########################################################
#
# Hello! Welcome to my source code.
#
# Here's a brief intro to how the program is structured, to encourage people
# to hack and improve.
#
# * The PageKite object contains the master configuration and some related
# routines. It takes care of parsing configuration files and implements
# things like the authentication protocol. It also contains the main event
# loop, which is select() or epoll() based. In short, it's the boss.
#
# * The Connections object keeps track of which tunnels and user connections
# are open at any given time and which protocol/domain pairs they belong to.
# It gets passed around as an argument quite a lot - not too elegant.
#
# * The Selectable and it's *Parser subclasses incrementally build up basic
# parsers for the supported protocols. Note that none of the protocols
# are fully implemented, we only implement the bare minimum required to
# figure out which back-end should handle a given request, and then forward
# the bytes unmodified over that channel. As a result, the current HTTP
# proxy code is not HTTP 1.1 compliant - but if you put it behind Varnish
# or some other decent reverse-proxy, then *the combination* should be!
#
# * The UserConn object represents connections on behalf of users. It can
# be created as a FrontEnd, which will find the right tunnel and send
# traffic to the back-end PageKite process, where a BackEnd UserConn
# will be created to connect to the actual HTTP server.
#
# * The Tunnel object represents one end of a PageKite tunnel and is also
# created either as a FrontEnd or BackEnd, depending on which end it is.
# Tunnels handle multiplexing and demultiplexing all the traffic for
# a given back-end so multiple requests can share a single TCP/IP
# connection.
#
# Although most of the work done by pagekite.py happens in an event-loop
# on a single thread, there are some exceptions:
#
# * The AuthThread handles checking whether an incoming tunnel request is
# allowed or not; authentication requests may end up blocking and waiting
# for each other, but the main work of proxying data back and forth won't
# be blocked.
#
# * The HttpUiThread implements a basic HTTP (or HTTPS) server, for basic
# monitoring and static file serving.
#
# WARNING: The UI threading code assumes it is running in CPython, where the
# GIL makes snooping across the thread-boundary relatively safe, even
# without explicit locking. Beware!
#
###############################################################################
#
PROTOVER = '0.8'
APPVER = '0.4.6a'
AUTHOR = 'Bjarni Runar Einarsson, http://bre.klaki.net/'
WWWHOME = 'http://pagekite.net/'
LICENSE_URL = 'http://www.gnu.org/licenses/agpl.html'
EXAMPLES = (\"\"\"\\
Basic usage, gives http://localhost:80/ a public name:
$ pagekite.py NAME.pagekite.me
To expose specific folders, files or use alternate local ports:
$ pagekite.py +indexes /a/path/ NAME.pagekite.me # built-in HTTPD
$ pagekite.py *.html NAME.pagekite.me # built-in HTTPD
$ pagekite.py 3000 NAME.pagekite.me # http://localhost:3000/
To expose multiple local servers (SSH and HTTP):
$ pagekite.py ssh://NAME.pagekite.me AND 3000 http://NAME.pagekite.me
\"\"\")
MINIDOC = (\"\"\"\\
>>> Welcome to pagekite.py v%s!
%s
To sign up with PageKite.net or get advanced instructions:
$ pagekite.py --signup
$ pagekite.py --help
If you request a kite which does not exist in your configuration file,
the program will offer to help you sign up with http://pagekite.net/ and
create it. Pick a name, any name!\"\"\") % (APPVER, EXAMPLES)
DOC = (\"\"\"\\
pagekite.py is Copyright 2010, 2011, the Beanstalks Project ehf.
v%s http://pagekite.net/
This the reference implementation of the PageKite tunneling protocol,
both the front- and back-end. This following protocols are supported:
HTTP - HTTP 1.1 only, requires a valid HTTP Host: header
HTTPS - Recent versions of TLS only, requires the SNI extension.
WEBSOCKET - Using the proposed Upgrade: WebSocket method.
Other protocols may be proxied by using \"raw\" back-ends and HTTP CONNECT.
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License. For the full text of the
license, see: http://www.gnu.org/licenses/agpl-3.0.html
Usage:
pagekite.py [options] [shortcuts]
Common Options:
--clean Skip loading the default configuration file.
--signup Interactively sign up for PageKite.net service.
--defaults Set defaults for use with PageKite.net service.
--local=ports Configure for local serving only (no remote front-end)
--optfile=X -o X Read settings from file X. Default is ~/.pagekite.rc.
--optdir=X -O X Read settings from *.rc in directory X.
--savefile=X -S X Saved settings will be written to file X.
--reloadfile=X Re-read settings from X on SIGHUP.
--autosave Enable auto-saving.
--noautosave Disable auto-saving.
--save Save this configuration.
--settings Dump the current settings to STDOUT, formatted as
an options file would be.
--httpd=X:P -H X:P Enable the HTTP user interface on hostname X, port P.
--pemfile=X -P X Use X as a PEM key for the HTTPS UI.
--httppass=X -X X Require password X to access the UI.
--nozchunks Disable zlib tunnel compression.
--sslzlib Enable zlib compression in OpenSSL.
--buffers N Buffer at most N kB of back-end data before blocking.
--logfile=F -L F Log to file F.
--daemonize -Z Run as a daemon.
--runas -U U:G Set UID:GID after opening our listening sockets.
--pidfile=P -I P Write PID to the named file.
--nocrashreport Don't send anonymous crash reports to PageKite.net.
--tls_default=N Default name to use for SSL, if SNI and tracking fail.
--tls_endpoint=N:F Terminate SSL/TLS for name N, using key/cert from F.
--errorurl=U -E U URL to redirect to when back-ends are not found.
Front-end Options:
--isfrontend -f Enable front-end mode.
--authdomain=X -A X Use X as a remote authentication domain.
--motd=/path/to/motd Send the contents of this file to new back-ends.
--host=H -h H Listen on H (hostname).
--ports=A,B,C -p A,B Listen on ports A, B, C, ...
--portalias=A:B Report port A as port B to backends.
--protos=A,B,C Accept the listed protocols for tunneling.
--rawports=A,B,C Listen on ports A, B, C, ... (raw/timed connections)
--domain=proto,proto2,pN:domain:secret
Accept tunneling requests for the named protocols and
specified domain, using the given secret. A * may be
used as a wildcard for subdomains or protocols.
Back-end Options:
--backend=proto:kitename:host:port:secret
Configure a back-end service on host:port, using protocol
proto and the given kite name as the public domain. As a
special case, if host is 'localhost' and the word 'built-in'
is used as a port number, pagekite.py's HTTP server will be used.
--define_backend=... Same as --backend, except not enabled by default.
--delete_backend=... Delete a given back-end.
--frontends=N:X:P Choose N front-ends from X (a DNS domain name), port P.
--frontend=host:port Connect to the named front-end server.
--fe_certname=N Connect using SSL, accepting valid certs for domain N.
--ca_certs=PATH Path to your trusted root SSL certificates file.
--dyndns=X -D X Register changes with DynDNS provider X. X can either
be simply the name of one of the 'built-in' providers,
or a URL format string for ad-hoc updating.
--all -a Terminate early if any tunnels fail to register.
--new -N Don't attempt to connect to the domain's old front-end.
--noprobes Reject all probes for back-end liveness.
--fingerpath=P Path recipe for the httpfinger back-end proxy.
--proxy=T:S:P Connect using a chain of proxies (requires socks.py)
--socksify=S:P Connect via SOCKS server S, port P (requires socks.py)
--torify=S:P Same as socksify, but more paranoid.
About the configuration file:
The configuration file contains the same options as are available to the
command line, with the restriction that there be exactly one \"option\"
per line.
The leading '--' may also be omitted for readability, and for the same
reason it is recommended to use the long form of the options in the
configuration file (also, the short form may not always parse correctly).
Blank lines and lines beginning with # (comments) are treated as comments
and are ignored. It is perfectly acceptable to have multiple configuration
files, and configuration files can include other configuration files.
NOTE: When using -o or --optfile on the command line, it is almost always
advisable to use --clean as well, to suppress the default configuration.
Examples:
Create a configuration file with default options, and then edit it.
$ pagekite.py --defaults --settings > ~/.pagekite.rc
$ vim ~/.pagekite.rc
Run the built-in HTTPD.
$ pagekite.py --defaults --httpd=localhost:9999
$ firefox http://localhost:9999/
Fly a PageKite on pagekite.net for somedomain.com, and register the
new front-ends with the No-IP Dynamic DNS provider.
$ pagekite.py \\\\
--defaults \\\\
--dyndns=user:pass@no-ip.com \\\\
--backend=http:kitename.com:localhost:80:mygreatsecret
Shortcuts:
A shortcut is simply the name of a kite following a list of zero or
more 'things' to expose using that name. Pagekite knows how to expose
either servers running on localhost ports or directories and files
using the built-in HTTP server. If no list of things to expose is
provided, the defaults for that kite are read from the configuration
file or http://localhost:80/ used as a last-resort default.
If a kite name is requested which does not already exist in the
configuration file and program is run interactively, the user
will be prompted and given the option of signing up and/or creating a
new kite using the PageKite.net service.
Multiple short-cuts can be specified on a single command-line,
separated by the word 'AND' (note capital letters are required).
This may cause problems if you have many files and folders by that
name, but that should be relatively rare. :-)
Shortcut examples:
\"\"\"+EXAMPLES) % APPVER
MAGIC_PREFIX = '/~:PageKite:~/'
MAGIC_PATH = '%sv%s' % (MAGIC_PREFIX, PROTOVER)
MAGIC_PATHS = (MAGIC_PATH, '/Beanstalk~Magic~Beans/0.2')
SERVICE_PROVIDER = 'PageKite.net'
SERVICE_DOMAINS = ('pagekite.me', )
SERVICE_XMLRPC = 'http://pagekite.net/xmlrpc/'
SERVICE_TOS_URL = 'https://pagekite.net/support/terms/'
OPT_FLAGS = 'o:O:S:H:P:X:L:ZI:fA:R:h:p:aD:U:NE:'
OPT_ARGS = ['noloop', 'clean', 'nopyopenssl', 'nossl', 'nocrashreport',
'nullui', 'remoteui', 'uiport=', 'help', 'settings',
'optfile=', 'optdir=', 'savefile=', 'reloadfile=',
'autosave', 'noautosave', 'friendly',
'signup', 'list', 'add', 'only', 'disable', 'remove', 'save',
'service_xmlrpc=', 'controlpanel', 'controlpass',
'httpd=', 'pemfile=', 'httppass=', 'errorurl=', 'webpath=',
'logfile=', 'daemonize', 'nodaemonize', 'runas=', 'pidfile=',
'isfrontend', 'noisfrontend', 'settings',
'defaults', 'local=', 'domain=',
'authdomain=', 'motd=', 'register=', 'host=',
'noupgradeinfo', 'upgradeinfo=',
'ports=', 'protos=', 'portalias=', 'rawports=',
'tls_default=', 'tls_endpoint=',
'fe_certname=', 'jakenoia', 'ca_certs=',
'kitename=', 'kitesecret=', 'fingerpath=',
'backend=', 'define_backend=', 'be_config=', 'delete_backend',
'frontend=', 'frontends=', 'torify=', 'socksify=', 'proxy=',
'new', 'all', 'noall', 'dyndns=', 'nozchunks', 'sslzlib',
'buffers=', 'noprobes', 'debugio',
# DEPRECATED:
'webroot=', 'webaccess=', 'webindexes=']
DEBUG_IO = False
DEFAULT_CHARSET = 'utf-8'
DEFAULT_BUFFER_MAX = 1024
AUTH_ERRORS = '255.255.255.'
AUTH_ERR_USER_UNKNOWN = '.0'
AUTH_ERR_INVALID = '.1'
AUTH_QUOTA_MAX = '255.255.254.255'
VIRTUAL_PN = 'virtual'
CATCHALL_HN = 'unknown'
LOOPBACK_HN = 'loopback'
LOOPBACK_FE = LOOPBACK_HN + ':1'
LOOPBACK_BE = LOOPBACK_HN + ':2'
LOOPBACK = {'FE': LOOPBACK_FE, 'BE': LOOPBACK_BE}
WEB_POLICY_DEFAULT = 'default'
WEB_POLICY_PUBLIC = 'public'
WEB_POLICY_PRIVATE = 'private'
WEB_POLICY_OTP = 'otp'
WEB_POLICIES = (WEB_POLICY_DEFAULT, WEB_POLICY_PUBLIC,
WEB_POLICY_PRIVATE, WEB_POLICY_OTP)
WEB_INDEX_ALL = 'all'
WEB_INDEX_ON = 'on'
WEB_INDEX_OFF = 'off'
WEB_INDEXTYPES = (WEB_INDEX_ALL, WEB_INDEX_ON, WEB_INDEX_OFF)
BE_PROTO = 0
BE_PORT = 1
BE_DOMAIN = 2
BE_BHOST = 3
BE_BPORT = 4
BE_SECRET = 5
BE_STATUS = 6
BE_STATUS_REMOTE_SSL = 0x0010000
BE_STATUS_OK = 0x0001000
BE_STATUS_ERR_DNS = 0x0000100
BE_STATUS_ERR_BE = 0x0000010
BE_STATUS_ERR_TUNNEL = 0x0000001
BE_STATUS_ERR_ANY = 0x0000fff
BE_STATUS_UNKNOWN = 0
BE_STATUS_DISABLED = 0x8000000
BE_STATUS_DISABLE_ONCE = 0x4000000
BE_INACTIVE = (BE_STATUS_DISABLED, BE_STATUS_DISABLE_ONCE)
BE_NONE = ['', '', None, None, None, '', BE_STATUS_UNKNOWN]
DYNDNS = {
'pagekite.net': ('http://up.pagekite.net/'
'?hostname=%(domain)s&myip=%(ips)s&sign=%(sign)s'),
'beanstalks.net': ('http://up.b5p.us/'
'?hostname=%(domain)s&myip=%(ips)s&sign=%(sign)s'),
'dyndns.org': ('https://%(user)s:%(pass)s@members.dyndns.org'
'/nic/update?wildcard=NOCHG&backmx=NOCHG'
'&hostname=%(domain)s&myip=%(ip)s'),
'no-ip.com': ('https://%(user)s:%(pass)s@dynupdate.no-ip.com'
'/nic/update?hostname=%(domain)s&myip=%(ip)s'),
}
##[ Standard imports ]########################################################
import base64
import cgi
from cgi import escape as escape_html
import errno
import getopt
import httplib
import os
import random
import re
import select
import socket
rawsocket = socket.socket
import struct
import sys
import tempfile
import threading
import time
import traceback
import urllib
import xmlrpclib
import zlib
import SocketServer
from CGIHTTPServer import CGIHTTPRequestHandler
from SimpleXMLRPCServer import SimpleXMLRPCServer, SimpleXMLRPCRequestHandler
import Cookie
# This should be our socksipy
import sockschain as socks
##[ Conditional imports & compatibility magic! ]###############################
# Create our service-domain matching regexp
SERVICE_DOMAIN_RE = re.compile('\\.(' + '|'.join(SERVICE_DOMAINS) + ')$')
SERVICE_SUBDOMAIN_RE = re.compile(r'^([A-Za-z0-9_-]+\\.)*[A-Za-z0-9_-]+$')
# System logging on Unix
try:
import syslog
except ImportError:
pass
# Backwards compatibility for old Pythons.
if not 'SHUT_RD' in dir(socket):
socket.SHUT_RD = 0
socket.SHUT_WR = 1
socket.SHUT_RDWR = 2
try:
import datetime
ts_to_date = datetime.datetime.fromtimestamp
except ImportError:
ts_to_date = str
try:
sorted([1, 2, 3])
except:
def sorted(l):
tmp = l[:]
tmp.sort()
return tmp
# SSL/TLS strategy: prefer pyOpenSSL, as it comes with built-in Context
# objects. If that fails, look for Python 2.6+ native ssl support and
# create a compatibility wrapper. If both fail, bomb with a ConfigError
# when the user tries to enable anything SSL-related.
SEND_ALWAYS_BUFFERS = False
SEND_MAX_BYTES = 16 * 1024
if socks.HAVE_PYOPENSSL:
SSL = socks.SSL
elif socks.HAVE_SSL:
SEND_ALWAYS_BUFFERS = True
SEND_MAX_BYTES = 4 * 1024
SSL = socks.SSL
else:
class SSL(object):
SSLv23_METHOD = 0
TLSv1_METHOD = 0
class Error(Exception): pass
class SysCallError(Exception): pass
class WantReadError(Exception): pass
class WantWriteError(Exception): pass
class ZeroReturnError(Exception): pass
class Context(object):
def __init__(self, method):
raise ConfigError('Neither pyOpenSSL nor python 2.6+ '
'ssl modules found!')
# Different Python 2.x versions complain about deprecation depending on
# where we pull these from.
try:
from urlparse import parse_qs, urlparse
except ImportError, e:
from cgi import parse_qs
from urlparse import urlparse
try:
import hashlib
def sha1hex(data):
hl = hashlib.sha1()
hl.update(data)
return hl.hexdigest().lower()
except ImportError:
import sha
def sha1hex(data):
return sha.new(data).hexdigest().lower()
# Enable system proxies
# This will all fail if we don't have PySocksipyChain available.
# FIXME: Move this code somewhere else?
socks.usesystemdefaults()
socks.wrapmodule(sys.modules[__name__])
if socks.HAVE_SSL:
# Secure connections to pagekite.net in SSL tunnels.
def_hop = socks.parseproxy('default')
https_hop = socks.parseproxy('httpcs:pagekite.net:443')
for dest in ('pagekite.net', 'up.pagekite.net', 'up.b5p.us'):
socks.setproxy(dest, *def_hop)
socks.addproxy(dest, *socks.parseproxy('http:%s:443' % dest))
socks.addproxy(dest, *https_hop)
else:
# FIXME: Should scream and shout about lack of security.
pass
# YamonD is a part of PageKite.net's internal monitoring systems. It's not
# required, so if you don't have it, the mock makes things Just Work.
class MockYamonD(object):
def __init__(self, sspec, server=None, handler=None): pass
def vmax(self, var, value): pass
def vscale(self, var, ratio, add=0): pass
def vset(self, var, value): pass
def vadd(self, var, value, wrap=None): pass
def vmin(self, var, value): pass
def vdel(self, var): pass
def lcreate(self, listn, elems): pass
def ladd(self, listn, value): pass
def render_vars_text(self): return ''
def quit(self): pass
def run(self): pass
YamonD = MockYamonD
gYamon = YamonD(())
class MockPageKiteXmlRpc:
def __init__(self, config):
self.config = config
def getSharedSecret(self, email, p):
for be in self.config.backends.values():
if be[BE_SECRET]: return be[BE_SECRET]
def getAvailableDomains(self, a, b):
return ['.%s' % x for x in SERVICE_DOMAINS]
def signUp(self, a, b):
return {
'secret': self.getSharedSecret(a, b)
}
def addCnameKite(self, a, s, k): return {}
def addKite(self, a, s, k): return {}
##[ PageKite.py code starts here! ]############################################
gSecret = None
def globalSecret():
global gSecret
if not gSecret:
# This always works...
gSecret = '%8.8x%s%8.8x' % (random.randint(0, 0x7FFFFFFE),
time.time(),
random.randint(0, 0x7FFFFFFE))
# Next, see if we can augment that with some real randomness.
try:
newSecret = sha1hex(open('/dev/urandom').read(64) + gSecret)
gSecret = newSecret
LogDebug('Seeded signatures using /dev/urandom, hooray!')
except:
try:
newSecret = sha1hex(os.urandom(64) + gSecret)
gSecret = newSecret
LogDebug('Seeded signatures using os.urandom(), hooray!')
except:
LogInfo('WARNING: Seeding signatures with time.time() and random.randint()')
return gSecret
TOKEN_LENGTH=36
def signToken(token=None, secret=None, payload='', timestamp=None,
length=TOKEN_LENGTH):
\"\"\"
This will generate a random token with a signature which could only have come
from this server. If a token is provided, it is re-signed so the original
can be compared with what we would have generated, for verification purposes.
If a timestamp is provided it will be embedded in the signature to a
resolution of 10 minutes, and the signature will begin with the letter 't'
Note: This is only as secure as random.randint() is random.
\"\"\"
if not secret: secret = globalSecret()
if not token: token = sha1hex('%s%8.8x' % (globalSecret(),
random.randint(0, 0x7FFFFFFD)+1))
if timestamp:
tok = 't' + token[1:]
ts = '%x' % int(timestamp/600)
return tok[0:8] + sha1hex(secret + payload + ts + tok[0:8])[0:length-8]
else:
return token[0:8] + sha1hex(secret + payload + token[0:8])[0:length-8]
def checkSignature(sign='', secret='', payload=''):
\"\"\"
Check a signature for validity. When using timestamped signatures, we only
accept signatures from the current and previous windows.
\"\"\"
if sign[0] == 't':
ts = int(time.time())
for window in (0, 1):
valid = signToken(token=sign, secret=secret, payload=payload,
timestamp=(ts-(window*600)))
if sign == valid: return True
return False
else:
valid = signToken(token=sign, secret=secret, payload=payload)
return sign == valid
class ConfigError(Exception):
pass
class ConnectError(Exception):
pass
def HTTP_PageKiteRequest(server, backends, tokens=None, nozchunks=False,
tls=False, testtoken=None, replace=None):
req = ['CONNECT PageKite:1 HTTP/1.0\\r\\n',
'X-PageKite-Version: %s\\r\\n' % APPVER]
if not nozchunks: req.append('X-PageKite-Features: ZChunks\\r\\n')
if replace: req.append('X-PageKite-Replace: %s\\r\\n' % replace)
if tls: req.append('X-PageKite-Features: TLS\\r\\n')
tokens = tokens or {}
for d in backends.keys():
if (backends[d][BE_BHOST] and
backends[d][BE_SECRET] and
backends[d][BE_STATUS] not in BE_INACTIVE):
# A stable (for replay on challenge) but unguessable salt.
my_token = sha1hex(globalSecret() + server + backends[d][BE_SECRET]
)[:TOKEN_LENGTH]
# This is the challenge (salt) from the front-end, if any.
server_token = d in tokens and tokens[d] or ''
# Our payload is the (proto, name) combined with both salts
data = '%s:%s:%s' % (d, my_token, server_token)
# Sign the payload with the shared secret (random salt).
sign = signToken(secret=backends[d][BE_SECRET],
payload=data,
token=testtoken)
req.append('X-PageKite: %s:%s\\r\\n' % (data, sign))
req.append('\\r\\n')
return ''.join(req)
def HTTP_ResponseHeader(code, title, mimetype='text/html'):
if mimetype.startswith('text/') and ';' not in mimetype:
mimetype += ('; charset=%s' % DEFAULT_CHARSET)
return ('HTTP/1.1 %s %s\\r\\nContent-Type: %s\\r\\nPragma: no-cache\\r\\n'
'Expires: 0\\r\\nCache-Control: no-store\\r\\nConnection: close'
'\\r\\n') % (code, title, mimetype)
def HTTP_Header(name, value):
return '%s: %s\\r\\n' % (name, value)
def HTTP_StartBody():
return '\\r\\n'
def HTTP_ConnectOK():
return 'HTTP/1.0 200 Connection Established\\r\\n\\r\\n'
def HTTP_ConnectBad():
return 'HTTP/1.0 503 Sorry\\r\\n\\r\\n'
def HTTP_Response(code, title, body, mimetype='text/html', headers=None):
data = [HTTP_ResponseHeader(code, title, mimetype)]
if headers: data.extend(headers)
data.extend([HTTP_StartBody(), ''.join(body)])
return ''.join(data)
def HTTP_NoFeConnection():
return HTTP_Response(200, 'OK', base64.decodestring(
'R0lGODlhCgAKAMQCAN4hIf/+/v///+EzM+AuLvGkpORISPW+vudgYOhiYvKpqeZY'
'WPbAwOdaWup1dfOurvW7u++Rkepycu6PjwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAACH5BAEAAAIALAAAAAAKAAoAAAUtoCAcyEA0jyhEQOs6AuPO'
'QJHQrjEAQe+3O98PcMMBDAdjTTDBSVSQEmGhEIUAADs='),
headers=[HTTP_Header('X-PageKite-Status', 'Down-FE')],
mimetype='image/gif')
def HTTP_NoBeConnection():
return HTTP_Response(200, 'OK', base64.decodestring(
'R0lGODlhCgAKAPcAAI9hE6t2Fv/GAf/NH//RMf/hd7u6uv/mj/ntq8XExMbFxc7N'
'zc/Ozv/xwfj31+jn5+vq6v///////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAACH5BAEAABIALAAAAAAKAAoAAAhDACUIlBAgwMCDARo4MHiQ'
'4IEGDAcGKAAAAESEBCoiiBhgQEYABzYK7OiRQIEDBgMIEDCgokmUKlcOKFkgZcGb'
'BSUEBAA7'),
headers=[HTTP_Header('X-PageKite-Status', 'Down-BE')],
mimetype='image/gif')
def HTTP_GoodBeConnection():
return HTTP_Response(200, 'OK', base64.decodestring(
'R0lGODlhCgAKANUCAEKtP0StQf8AAG2/a97w3qbYpd/x3mu/aajZp/b79vT69Mnn'
'yK7crXTDcqraqcfmxtLr0VG0T0ivRpbRlF24Wr7jveHy4Pv9+53UnPn8+cjnx4LI'
'gNfu1v///37HfKfZpq/crmG6XgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAACH5BAEAAAIALAAAAAAKAAoAAAZIQIGAUDgMEASh4BEANAGA'
'xRAaaHoYAAPCCZUoOIDPAdCAQhIRgJGiAG0uE+igAMB0MhYoAFmtJEJcBgILVU8B'
'GkpEAwMOggJBADs='),
headers=[HTTP_Header('X-PageKite-Status', 'OK')],
mimetype='image/gif')
def HTTP_Unavailable(where, proto, domain, comment='', frame_url=None,
code=503, status='Unavailable', headers=None):
if code == 401:
headers = headers or []
headers.append(HTTP_Header('WWW-Authenticate', 'Basic realm=PageKite'))
message = ''.join(['
Sorry! (', where, ')
',
'
The ', proto.upper(),' ',
'PageKite for ', domain,
' is unavailable at the moment.
',
'
Please try again later.
'])
if frame_url:
if '?' in frame_url:
frame_url += '&where=%s&proto=%s&domain=%s' % (where.upper(), proto, domain)
return HTTP_Response(code, status,
[''], headers=headers)
else:
return HTTP_Response(code, status,
['', message, ''],
headers=headers)
LOG = []
LOG_LINE = 0
LOG_LENGTH = 300
LOG_THRESHOLD = 256 * 1024
def LogValues(values, testtime=None):
global LOG_LINE, LOG_LAST_TIME
now = int(testtime or time.time())
words = [('ts', '%x' % now),
('t', '%s' % datetime.datetime.fromtimestamp(now).isoformat()),
('ll', '%x' % LOG_LINE)]
words.extend([(kv[0], ('%s' % kv[1]).replace('\\t', ' ')
.replace('\\r', ' ')
.replace('\\n', ' ')
.replace('; ', ', ')
.strip()) for kv in values])
wdict = dict(words)
LOG_LINE += 1
LOG.append(wdict)
while len(LOG) > LOG_LENGTH: LOG.pop(0)
return (words, wdict)
def LogSyslog(values, wdict=None, words=None):
if values:
words, wdict = LogValues(values)
if 'err' in wdict:
syslog.syslog(syslog.LOG_ERR, '; '.join(['='.join(x) for x in words]))
elif 'debug' in wdict:
syslog.syslog(syslog.LOG_DEBUG, '; '.join(['='.join(x) for x in words]))
else:
syslog.syslog(syslog.LOG_INFO, '; '.join(['='.join(x) for x in words]))
LogFile = sys.stdout
def LogToFile(values, wdict=None, words=None):
if values:
words, wdict = LogValues(values)
LogFile.write('; '.join(['='.join(x) for x in words]))
LogFile.write('\\n')
def LogToMemory(values, wdict=None, words=None):
if values: LogValues(values)
def FlushLogMemory():
for l in LOG:
Log(None, wdict=l, words=[(w, l[w]) for w in l])
Log = LogToMemory
def LogError(msg, parms=None):
emsg = [('err', msg)]
if parms: emsg.extend(parms)
Log(emsg)
global gYamon
gYamon.vadd('errors', 1, wrap=1000000)
def LogDebug(msg, parms=None):
emsg = [('debug', msg)]
if parms: emsg.extend(parms)
Log(emsg)
def LogInfo(msg, parms=None):
emsg = [('info', msg)]
if parms: emsg.extend(parms)
Log(emsg)
# FIXME: This could easily be a pool of threads to let us handle more
# than one incoming request at a time.
class AuthThread(threading.Thread):
\"\"\"Handle authentication work in a separate thread.\"\"\"
#daemon = True
def __init__(self, conns):
threading.Thread.__init__(self)
self.qc = threading.Condition()
self.jobs = []
self.conns = conns
def check(self, requests, conn, callback):
self.qc.acquire()
self.jobs.append((requests, conn, callback))
self.qc.notify()
self.qc.release()
def quit(self):
self.qc.acquire()
self.keep_running = False
self.qc.notify()
self.qc.release()
try:
self.join()
except RuntimeError:
pass
def run(self):
self.keep_running = True
while self.keep_running:
try:
self._run()
except Exception, e:
LogError('AuthThread died: %s' % e)
time.sleep(5)
LogDebug('AuthThread: done')
def _run(self):
self.qc.acquire()
while self.keep_running:
now = int(time.time())
if self.jobs:
(requests, conn, callback) = self.jobs.pop(0)
if DEBUG_IO: print '=== AUTH REQUESTS\\n%s\\n===' % requests
self.qc.release()
quotas = []
results = []
session = '%x:%s:' % (now, globalSecret())
for request in requests:
try:
proto, domain, srand, token, sign, prefix = request
except:
LogError('Invalid request: %s' % (request, ))
continue
what = '%s:%s:%s' % (proto, domain, srand)
session += what
if not token or not sign:
# Send a challenge. Our challenges are time-stamped, so we can
# put stict bounds on possible replay attacks (20 minutes atm).
results.append(('%s-SignThis' % prefix,
'%s:%s' % (what, signToken(payload=what,
timestamp=now))))
else:
# This is a bit lame, but we only check the token if the quota
# for this connection has never been verified.
(quota, reason) = self.conns.config.GetDomainQuota(proto,
domain, srand, token, sign,
check_token=(conn.quota is None))
if not quota:
if not reason: reason = 'quota'
results.append(('%s-Invalid' % prefix, what))
results.append(('%s-Invalid-Why' % prefix,
'%s;%s' % (what, reason)))
Log([('rejected', domain),
('quota', quota),
('reason', reason)])
elif self.conns.Tunnel(proto, domain):
# FIXME: Allow multiple backends?
results.append(('%s-Duplicate' % prefix, what))
Log([('rejected', domain),
('duplicate', 'yes')])
else:
results.append(('%s-OK' % prefix, what))
quotas.append(quota)
if (proto.startswith('http') and
self.conns.config.GetTlsEndpointCtx(domain)):
results.append(('%s-SSL-OK' % prefix, what))
results.append(('%s-SessionID' % prefix,
'%x:%s' % (now, sha1hex(session))))
results.append(('%s-Misc' % prefix, urllib.urlencode({
'motd': (self.conns.config.motd_message or ''),
})))
for upgrade in self.conns.config.upgrade_info:
results.append(('%s-Upgrade' % prefix, ';'.join(upgrade)))
if quotas:
nz_quotas = [q for q in quotas if q and q > 0]
if nz_quotas:
quota = min(nz_quotas)
if quota is not None:
conn.quota = [quota, requests[quotas.index(quota)], time.time()]
results.append(('%s-Quota' % prefix, quota))
elif requests:
if not conn.quota:
conn.quota = [None, requests[0], time.time()]
else:
conn.quota[2] = time.time()
if DEBUG_IO: print '=== AUTH RESULTS\\n%s\\n===' % results
callback(results)
self.qc.acquire()
else:
self.qc.wait()
self.buffering = 0
self.qc.release()
HTTP_METHODS = ['OPTIONS', 'CONNECT', 'GET', 'HEAD', 'POST', 'PUT', 'TRACE',
'PROPFIND', 'PROPPATCH', 'MKCOL', 'DELETE', 'COPY', 'MOVE',
'LOCK', 'UNLOCK', 'PING']
HTTP_VERSIONS = ['HTTP/1.0', 'HTTP/1.1']
##[ Protocol parsers! ]########################################################
class BaseLineParser(object):
\"\"\"Base protocol parser class.\"\"\"
PROTO = 'unknown'
PROTOS = ['unknown']
PARSE_UNKNOWN = -2
PARSE_FAILED = -1
PARSE_OK = 100
def __init__(self, lines=None, state=PARSE_UNKNOWN, proto=PROTO):
self.state = state
self.protocol = proto
self.lines = []
self.domain = None
self.last_parser = self
if lines is not None:
for line in lines:
if not self.Parse(line): break
def ParsedOK(self):
return (self.state == self.PARSE_OK)
def Parse(self, line):
self.lines.append(line)
return False
def ErrorReply(self, port=None):
return ''
class MagicLineParser(BaseLineParser):
\"\"\"Parse an unknown incoming connection request, line-by-line.\"\"\"
PROTO = 'magic'
def __init__(self, lines=None, state=BaseLineParser.PARSE_UNKNOWN,
parsers=[]):
self.parsers = [p() for p in parsers]
BaseLineParser.__init__(self, lines, state, self.PROTO)
if self.last_parser == self:
self.last_parser = self.parsers[-1]
def ParsedOK(self):
return self.last_parser.ParsedOK()
def Parse(self, line):
BaseLineParser.Parse(self, line)
self.last_parser = self.parsers[-1]
for p in self.parsers[:]:
if not p.Parse(line):
self.parsers.remove(p)
elif p.ParsedOK():
self.last_parser = p
self.domain = p.domain
self.protocol = p.protocol
self.state = p.state
self.parsers = [p]
break
if not self.parsers:
LogDebug('No more parsers!')
return (len(self.parsers) > 0)
class HttpLineParser(BaseLineParser):
\"\"\"Parse an HTTP request, line-by-line.\"\"\"
PROTO = 'http'
PROTOS = ['http']
IN_REQUEST = 11
IN_HEADERS = 12
IN_BODY = 13
IN_RESPONSE = 14
def __init__(self, lines=None, state=IN_REQUEST, testbody=False):
self.method = None
self.path = None
self.version = None
self.code = None
self.message = None
self.headers = []
self.body_result = testbody
BaseLineParser.__init__(self, lines, state, self.PROTO)
def ParseResponse(self, line):
self.version, self.code, self.message = line.split()
if not self.version.upper() in HTTP_VERSIONS:
LogDebug('Invalid version: %s' % self.version)
return False
self.state = self.IN_HEADERS
return True
def ParseRequest(self, line):
self.method, self.path, self.version = line.split()
if not self.method in HTTP_METHODS:
LogDebug('Invalid method: %s' % self.method)
return False
if not self.version.upper() in HTTP_VERSIONS:
LogDebug('Invalid version: %s' % self.version)
return False
self.state = self.IN_HEADERS
return True
def ParseHeader(self, line):
if line in ('', '\\r', '\\n', '\\r\\n'):
self.state = self.IN_BODY
return True
header, value = line.split(':', 1)
if value and value.startswith(' '): value = value[1:]
self.headers.append((header.lower(), value))
return True
def ParseBody(self, line):
# Could be overridden by subclasses, for now we just play dumb.
return self.body_result
def ParsedOK(self):
return (self.state == self.IN_BODY)
def Parse(self, line):
BaseLineParser.Parse(self, line)
try:
if (self.state == self.IN_RESPONSE):
return self.ParseResponse(line)
elif (self.state == self.IN_REQUEST):
return self.ParseRequest(line)
elif (self.state == self.IN_HEADERS):
return self.ParseHeader(line)
elif (self.state == self.IN_BODY):
return self.ParseBody(line)
except ValueError, err:
LogDebug('Parse failed: %s, %s, %s' % (self.state, err, self.lines))
self.state = BaseLineParser.PARSE_FAILED
return False
def Header(self, header):
return [h[1].strip() for h in self.headers if h[0] == header.lower()]
class FingerLineParser(BaseLineParser):
\"\"\"Parse an incoming Finger request, line-by-line.\"\"\"
PROTO = 'finger'
PROTOS = ['finger', 'httpfinger']
WANT_FINGER = 71
def __init__(self, lines=None, state=WANT_FINGER):
BaseLineParser.__init__(self, lines, state, self.PROTO)
def ErrorReply(self, port=None):
if port == 79:
return ('PageKite wants to know, what domain?\\n'
'Try: finger user+domain@domain\\n')
else:
return ''
def Parse(self, line):
BaseLineParser.Parse(self, line)
if ' ' in line: return False
if '+' in line:
arg0, self.domain = line.strip().split('+', 1)
elif '@' in line:
arg0, self.domain = line.strip().split('@', 1)
if self.domain:
self.state = BaseLineParser.PARSE_OK
self.lines[-1] = '%s\\n' % arg0
return True
else:
self.state = BaseLineParser.PARSE_FAILED
return False
class IrcLineParser(BaseLineParser):
\"\"\"Parse an incoming IRC connection, line-by-line.\"\"\"
PROTO = 'irc'
PROTOS = ['irc']
WANT_USER = 61
def __init__(self, lines=None, state=WANT_USER):
self.seen = []
BaseLineParser.__init__(self, lines, state, self.PROTO)
def ErrorReply(self):
return ':pagekite 451 :IRC Gateway requires user@HOST or nick@HOST\\n'
def Parse(self, line):
BaseLineParser.Parse(self, line)
if line in ('\\n', '\\r\\n'): return True
if self.state == IrcLineParser.WANT_USER:
try:
ocmd, arg = line.strip().split(' ', 1)
cmd = ocmd.lower()
self.seen.append(cmd)
args = arg.split(' ')
if cmd == 'pass':
pass
elif cmd in ('user', 'nick'):
if '@' in args[0]:
parts = args[0].split('@')
self.domain = parts[-1]
arg0 = '@'.join(parts[:-1])
elif 'nick' in self.seen and 'user' in self.seen and not self.domain:
raise Error('No domain found')
if self.domain:
self.state = BaseLineParser.PARSE_OK
self.lines[-1] = '%s %s %s\\n' % (ocmd, arg0, ' '.join(args[1:]))
else:
self.state = BaseLineParser.PARSE_FAILED
except Exception, err:
LogDebug('Parse failed: %s, %s, %s' % (self.state, err, self.lines))
self.state = BaseLineParser.PARSE_FAILED
return (self.state != BaseLineParser.PARSE_FAILED)
##[ Selectables ]##############################################################
def obfuIp(ip):
quads = ('%s' % ip).replace(':', '.').split('.')
return '~%s' % '.'.join([q for q in quads[-2:]])
selectable_id = 0
buffered_bytes = 0
SELECTABLES = None
class Selectable(object):
\"\"\"A wrapper around a socket, for use with select.\"\"\"
HARMLESS_ERRNOS = (errno.EINTR, errno.EAGAIN, errno.ENOMEM, errno.EBUSY,
errno.EDEADLK, errno.EWOULDBLOCK, errno.ENOBUFS,
errno.EALREADY)
def __init__(self, fd=None, address=None, on_port=None, maxread=16000,
ui=None, tracked=True, bind=None, backlog=100):
self.fd = None
try:
self.SetFD(fd or rawsocket(socket.AF_INET6, socket.SOCK_STREAM), six=True)
if bind:
self.fd.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
self.fd.bind(bind)
self.fd.listen(backlog)
self.fd.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
except:
self.SetFD(fd or rawsocket(socket.AF_INET, socket.SOCK_STREAM))
if bind:
self.fd.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
self.fd.bind(bind)
self.fd.listen(backlog)
self.fd.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
self.address = address
self.on_port = on_port
self.created = self.bytes_logged = time.time()
self.last_activity = 0
self.dead = False
self.ui = ui
# Quota-related stuff
self.quota = None
# Read-related variables
self.maxread = maxread
self.read_bytes = self.all_in = 0
self.read_eof = False
self.peeking = False
self.peeked = 0
# Write-related variables
self.wrote_bytes = self.all_out = 0
self.write_blocked = ''
self.write_speed = 102400
self.write_eof = False
self.write_retry = None
# Throttle reads and writes
self.throttle_until = 0
# Compression stuff
self.zw = None
self.zlevel = 1
self.zreset = False
# Logging
self.logged = []
global selectable_id
selectable_id += 1
selectable_id %= 0x10000
self.sid = selectable_id
self.alt_id = None
if address:
addr = address or ('x.x.x.x', 'x')
self.log_id = 's%x/%s:%s' % (self.sid, obfuIp(addr[0]), addr[1])
else:
self.log_id = 's%x' % self.sid
# Introspection
global SELECTABLES
if SELECTABLES is not None:
SELECTABLES.append(self)
global gYamon
self.countas = 'selectables_live'
gYamon.vadd(self.countas, 1)
gYamon.vadd('selectables', 1)
def CountAs(self, what):
global gYamon
gYamon.vadd(self.countas, -1)
self.countas = what
gYamon.vadd(self.countas, 1)
def __del__(self):
global gYamon
gYamon.vadd(self.countas, -1)
gYamon.vadd('selectables', -1)
def __str__(self):
return '%s: %s' % (self.log_id, self.__class__)
def __html__(self):
try:
peer = self.fd.getpeername()
sock = self.fd.getsockname()
except Exception:
peer = ('x.x.x.x', 'x')
sock = ('x.x.x.x', 'x')
return ('Outgoing ZChunks: %s '
'Buffered bytes: %s '
'Remote address: %s '
'Local address: %s '
'Bytes in / out: %s / %s '
'Created: %s '
'Status: %s '
' '
'Logged:
%s
'
'\\n') % (self.zw and ('level %d' % self.zlevel) or 'off',
len(self.write_blocked),
self.dead and '-' or (obfuIp(peer[0]), peer[1]),
self.dead and '-' or (obfuIp(sock[0]), sock[1]),
self.all_in + self.read_bytes,
self.all_out + self.wrote_bytes,
time.strftime('%Y-%m-%d %H:%M:%S',
time.localtime(self.created)),
self.dead and 'dead' or 'alive',
''.join(['
%s' % (l, ) for l in self.logged]))
def ResetZChunks(self):
if self.zw:
self.zreset = True
self.zw = zlib.compressobj(self.zlevel)
def EnableZChunks(self, level=1):
self.zlevel = level
self.zw = zlib.compressobj(level)
def SetFD(self, fd, six=False):
if self.fd:
self.fd.close()
self.fd = fd
self.fd.setblocking(0)
try:
if six: self.fd.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0)
self.fd.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)
self.fd.setsockopt(socket.SOL_TCP, socket.TCP_KEEPIDLE, 60)
self.fd.setsockopt(socket.SOL_TCP, socket.TCP_KEEPCNT, 10)
self.fd.setsockopt(socket.SOL_TCP, socket.TCP_KEEPINTVL, 1)
except Exception:
pass
def SetConn(self, conn):
self.SetFD(conn.fd)
self.log_id = conn.log_id
self.read_bytes = conn.read_bytes
self.wrote_bytes = conn.wrote_bytes
def Log(self, values):
if self.log_id: values.append(('id', self.log_id))
Log(values)
self.logged.append(('', values))
def LogError(self, error, params=None):
values = params or []
if self.log_id: values.append(('id', self.log_id))
LogError(error, values)
self.logged.append((error, values))
def LogDebug(self, message, params=None):
values = params or []
if self.log_id: values.append(('id', self.log_id))
LogDebug(message, values)
self.logged.append((message, values))
def LogInfo(self, message, params=None):
values = params or []
if self.log_id: values.append(('id', self.log_id))
LogInfo(message, values)
self.logged.append((message, values))
def LogTraffic(self, final=False):
if self.wrote_bytes or self.read_bytes:
now = time.time()
self.all_out += self.wrote_bytes
self.all_in += self.read_bytes
if self.ui: self.ui.Status('traffic')
global gYamon
gYamon.vadd(\"bytes_all\", self.wrote_bytes
+ self.read_bytes, wrap=1000000000)
if final:
self.Log([('wrote', '%d' % self.wrote_bytes),
('wbps', '%d' % self.write_speed),
('read', '%d' % self.read_bytes),
('eof', '1')])
else:
self.Log([('wrote', '%d' % self.wrote_bytes),
('wbps', '%d' % self.write_speed),
('read', '%d' % self.read_bytes)])
self.bytes_logged = now
self.wrote_bytes = self.read_bytes = 0
elif final:
self.Log([('eof', '1')])
def Cleanup(self, close=True):
global buffered_bytes
buffered_bytes -= len(self.write_blocked)
self.write_blocked = self.peeked = self.zw = ''
if not self.dead:
self.dead = True
self.CountAs('selectables_dead')
if close:
if self.fd:
self.fd.close()
self.LogTraffic(final=True)
self.fd = None
def SayHello(self):
pass
def ProcessData(self, data):
self.LogError('Selectable::ProcessData: Should be overridden!')
return False
def ProcessEof(self):
if self.read_eof and self.write_eof and not self.write_blocked:
self.Cleanup()
return False
return True
def ProcessEofRead(self):
self.read_eof = True
self.LogError('Selectable::ProcessEofRead: Should be overridden!')
return False
def ProcessEofWrite(self):
self.write_eof = True
self.LogError('Selectable::ProcessEofWrite: Should be overridden!')
return False
def EatPeeked(self, eat_bytes=None, keep_peeking=False):
if not self.peeking: return
if eat_bytes is None: eat_bytes = self.peeked
discard = ''
while len(discard) < eat_bytes:
try:
discard += self.fd.recv(eat_bytes - len(discard))
except socket.error, (errno, msg):
self.LogInfo('Error reading (%d/%d) socket: %s (errno=%s)' % (
eat_bytes, self.peeked, msg, errno))
time.sleep(0.1)
self.peeked -= eat_bytes
self.peeking = keep_peeking
return
def ReadData(self, maxread=None):
if self.read_eof:
return False
try:
maxread = maxread or self.maxread
if self.peeking:
data = self.fd.recv(maxread, socket.MSG_PEEK)
self.peeked = len(data)
if DEBUG_IO: print '<== IN (peeked)\\n%s\\n===' % data
else:
data = self.fd.recv(maxread)
if DEBUG_IO: print '<== IN\\n%s\\n===' % data
except (SSL.WantReadError, SSL.WantWriteError), err:
return True
except IOError, err:
if err.errno not in self.HARMLESS_ERRNOS:
self.LogDebug('Error reading socket: %s (%s)' % (err, err.errno))
return False
else:
return True
except (SSL.Error, SSL.ZeroReturnError, SSL.SysCallError), err:
self.LogDebug('Error reading socket (SSL): %s' % err)
return False
except socket.error, (errno, msg):
if errno in self.HARMLESS_ERRNOS:
return True
else:
self.LogInfo('Error reading socket: %s (errno=%s)' % (msg, errno))
return False
self.last_activity = time.time()
if data is None or data == '':
self.read_eof = True
return self.ProcessData('')
else:
if not self.peeking:
self.read_bytes += len(data)
if self.read_bytes > LOG_THRESHOLD: self.LogTraffic()
return self.ProcessData(data)
def Throttle(self, max_speed=None, remote=False, delay=0.2):
if max_speed:
self.throttle_until = time.time()
flooded = self.read_bytes + self.all_in
flooded -= max_speed * (time.time() - self.created)
delay = min(15, max(0.2, flooded/max_speed))
if flooded < 0: delay = 15
else:
if self.throttle_until < time.time(): self.throttle_until = time.time()
flooded = '?'
self.throttle_until += delay
self.LogInfo('Throttled until %x (flooded=%s, bps=%s, remote=%s)' % (
int(self.throttle_until), flooded, max_speed, remote))
return True
def Send(self, data, try_flush=False):
global buffered_bytes
buffered_bytes -= len(self.write_blocked)
# If we're already blocked, just buffer unless explicitly asked to flush.
if (not try_flush) and (len(self.write_blocked) > 0 or SEND_ALWAYS_BUFFERS):
self.write_blocked += ''.join(data)
buffered_bytes += len(self.write_blocked)
return True
self.write_speed = int((self.wrote_bytes + self.all_out) / (0.1 + time.time() - self.created))
sending = self.write_blocked+(''.join(data))
self.write_blocked = ''
sent_bytes = 0
if sending:
try:
sent_bytes = self.fd.send(sending[:(self.write_retry or SEND_MAX_BYTES)])
if DEBUG_IO: print '==> OUT\\n%s\\n===' % sending[:sent_bytes]
self.wrote_bytes += sent_bytes
self.write_retry = None
except IOError, err:
if err.errno not in self.HARMLESS_ERRNOS:
self.LogInfo('Error sending: %s' % err)
self.ProcessEofWrite()
return False
else:
self.write_retry = len(sending)
except (SSL.WantWriteError, SSL.WantReadError), err:
self.write_retry = len(sending)
except socket.error, (errno, msg):
if errno not in self.HARMLESS_ERRNOS:
self.LogInfo('Error sending: %s (errno=%s)' % (msg, errno))
self.ProcessEofWrite()
return False
else:
self.write_retry = len(sending)
except (SSL.Error, SSL.ZeroReturnError, SSL.SysCallError), err:
self.LogInfo('Error sending (SSL): %s' % err)
self.ProcessEofWrite()
return False
self.write_blocked = sending[sent_bytes:]
buffered_bytes += len(self.write_blocked)
if self.wrote_bytes >= LOG_THRESHOLD: self.LogTraffic()
if self.write_eof and not self.write_blocked: self.ProcessEofWrite()
return True
def SendChunked(self, data, compress=True, zhistory=None):
rst = ''
if self.zreset:
self.zreset = False
rst = 'R'
# Stop compressing streams that just get bigger.
if zhistory and (zhistory[0] < zhistory[1]): compress = False
sdata = ''.join(data)
if self.zw and compress:
try:
zdata = self.zw.compress(sdata) + self.zw.flush(zlib.Z_SYNC_FLUSH)
if zhistory:
zhistory[0] = len(sdata)
zhistory[1] = len(zdata)
return self.Send(['%xZ%x%s\\r\\n%s' % (len(sdata), len(zdata), rst, zdata)])
except zlib.error:
LogError('Error compressing, resetting ZChunks.')
self.ResetZChunks()
return self.Send(['%x%s\\r\\n%s' % (len(sdata), rst, sdata)])
def Flush(self, loops=50, wait=False):
while loops != 0 and len(self.write_blocked) > 0 and self.Send([],
try_flush=True):
if wait and len(self.write_blocked) > 0:
time.sleep(0.1)
LogDebug('Flushing...')
loops -= 1
if self.write_blocked: return False
return True
class Connections(object):
\"\"\"A container for connections (Selectables), config and tunnel info.\"\"\"
def __init__(self, config):
self.config = config
self.ip_tracker = {}
self.idle = []
self.conns = []
self.conns_by_id = {}
self.tunnels = {}
self.auth = None
def start(self, auth_thread=None):
self.auth = auth_thread or AuthThread(self)
self.auth.start()
def Add(self, conn, alt_id=None):
self.idle.append(conn)
self.conns.append(conn)
if alt_id: self.conns_by_id[alt_id] = conn
def TrackIP(self, ip, domain):
tick = '%d' % (time.time()/12)
if tick not in self.ip_tracker:
deadline = int(tick)-10
for ot in self.ip_tracker.keys():
if int(ot) < deadline: del self.ip_tracker[ot]
self.ip_tracker[tick] = {}
if ip not in self.ip_tracker[tick]:
self.ip_tracker[tick][ip] = [1, domain]
else:
self.ip_tracker[tick][ip][0] += 1
self.ip_tracker[tick][ip][1] = domain
def LastIpDomain(self, ip):
domain = None
for tick in sorted(self.ip_tracker.keys()):
if ip in self.ip_tracker[tick]: domain = self.ip_tracker[tick][ip][1]
return domain
def Remove(self, conn):
try:
if conn.alt_id and conn.alt_id in self.conns_by_id:
del self.conns_by_id[conn.alt_id]
if conn in self.conns:
self.conns.remove(conn)
if conn in self.idle:
self.idle.remove(conn)
for tid in self.tunnels.keys():
if conn in self.tunnels[tid]:
self.tunnels[tid].remove(conn)
if not self.tunnels[tid]: del self.tunnels[tid]
except ValueError:
# Let's not asplode if another thread races us for this.
pass
def Readable(self):
# FIXME: This is O(n)
now = time.time()
return [s.fd for s in self.conns if (s.fd
and (not s.read_eof)
and (s.throttle_until <= now))]
def Blocked(self):
# FIXME: This is O(n)
return [s.fd for s in self.conns if s.fd and len(s.write_blocked) > 0]
def DeadConns(self):
return [s for s in self.conns if s.read_eof and s.write_eof and not s.write_blocked]
def CleanFds(self):
evil = []
for s in self.conns:
try:
i, o, e = select.select([s.fd], [s.fd], [s.fd], 0)
except Exception:
evil.append(s)
for s in evil:
LogDebug('Removing broken Selectable: %s' % s)
self.Remove(s)
def Connection(self, fd):
for conn in self.conns:
if conn.fd == fd:
return conn
return None
def TunnelServers(self):
servers = {}
for tid in self.tunnels:
for tunnel in self.tunnels[tid]:
server = tunnel.server_info[tunnel.S_NAME]
if server is not None:
servers[server] = 1
return servers.keys()
def Tunnel(self, proto, domain, conn=None):
tid = '%s:%s' % (proto, domain)
if conn is not None:
if tid not in self.tunnels:
self.tunnels[tid] = []
self.tunnels[tid].append(conn)
if tid in self.tunnels:
return self.tunnels[tid]
else:
try:
dparts = domain.split('.')[1:]
while len(dparts) > 1:
wild_tid = '%s:*.%s' % (proto, '.'.join(dparts))
if wild_tid in self.tunnels:
return self.tunnels[wild_tid]
dparts = dparts[1:]
except:
pass
return []
class LineParser(Selectable):
\"\"\"A Selectable which parses the input as lines of text.\"\"\"
def __init__(self, fd=None, address=None, on_port=None,
ui=None, tracked=True):
Selectable.__init__(self, fd, address, on_port, ui=ui, tracked=tracked)
self.leftovers = ''
def __html__(self):
return Selectable.__html__(self)
def Cleanup(self, close=True):
Selectable.Cleanup(self, close=close)
self.leftovers = ''
def ProcessData(self, data):
lines = (self.leftovers+data).splitlines(True)
self.leftovers = ''
while lines:
line = lines.pop(0)
if line.endswith('\\n'):
if self.ProcessLine(line, lines) is False:
return False
else:
if not self.peeking: self.leftovers += line
if self.read_eof: return self.ProcessEofRead()
return True
def ProcessLine(self, line, lines):
self.LogError('LineParser::ProcessLine: Should be overridden!')
return False
TLS_CLIENTHELLO = '%c' % 026
SSL_CLIENTHELLO = '\\x80'
# FIXME: XMPP support
class MagicProtocolParser(LineParser):
\"\"\"A Selectable which recognizes HTTP, TLS or XMPP preambles.\"\"\"
def __init__(self, fd=None, address=None, on_port=None, ui=None):
LineParser.__init__(self, fd, address, on_port, ui=ui, tracked=False)
self.leftovers = ''
self.might_be_tls = True
self.is_tls = False
self.my_tls = False
def __html__(self):
return ('Detected TLS: %s '
'%s') % (self.is_tls,
LineParser.__html__(self))
# FIXME: DEPRECATE: Make this all go away, switch to CONNECT.
def ProcessMagic(self, data):
args = {}
try:
prefix, words, data = data.split('\\r\\n', 2)
for arg in words.split('; '):
key, val = arg.split('=', 1)
args[key] = val
self.EatPeeked(eat_bytes=len(prefix)+2+len(words)+2)
except ValueError, e:
return True
try:
port = 'port' in args and args['port'] or None
if port: self.on_port = int(port)
except ValueError, e:
return False
proto = 'proto' in args and args['proto'] or None
if proto in ('http', 'http2', 'http3', 'websocket'):
return LineParser.ProcessData(self, data)
domain = 'domain' in args and args['domain'] or None
if proto == 'https': return self.ProcessTls(data, domain)
if proto == 'raw' and domain: return self.ProcessRaw(data, domain)
return False
def ProcessData(self, data):
if data.startswith(MAGIC_PREFIX): return self.ProcessMagic(data)
if self.might_be_tls:
self.might_be_tls = False
if not data.startswith(TLS_CLIENTHELLO) and not data.startswith(SSL_CLIENTHELLO):
self.EatPeeked()
return LineParser.ProcessData(self, data)
self.is_tls = True
if self.is_tls:
return self.ProcessTls(data)
else:
self.EatPeeked()
return LineParser.ProcessData(self, data)
def GetMsg(self, data):
mtype, ml24, mlen = struct.unpack('>BBH', data[0:4])
mlen += ml24 * 0x10000
return mtype, data[4:4+mlen], data[4+mlen:]
def GetClientHelloExtensions(self, msg):
# Ugh, so many magic numbers! These are accumulated sizes of
# the different fields we are ignoring in the TLS headers.
slen = struct.unpack('>B', msg[34])[0]
cslen = struct.unpack('>H', msg[35+slen:37+slen])[0]
cmlen = struct.unpack('>B', msg[37+slen+cslen])[0]
extofs = 34+1+2+1+2+slen+cslen+cmlen
if extofs < len(msg): return msg[extofs:]
return None
def GetSniNames(self, extensions):
names = []
while extensions:
etype, elen = struct.unpack('>HH', extensions[0:4])
if etype == 0:
# OK, we found an SNI extension, get the list.
namelist = extensions[6:4+elen]
while namelist:
ntype, nlen = struct.unpack('>BH', namelist[0:3])
if ntype == 0: names.append(namelist[3:3+nlen].lower())
namelist = namelist[3+nlen:]
extensions = extensions[4+elen:]
return names
def GetSni(self, data):
hello, vmajor, vminor, mlen = struct.unpack('>BBBH', data[0:5])
data = data[5:]
sni = []
while data:
mtype, msg, data = self.GetMsg(data)
if mtype == 1:
# ClientHello!
sni.extend(self.GetSniNames(self.GetClientHelloExtensions(msg)))
return sni
def ProcessTls(self, data, domain=None):
self.LogError('TlsOrLineParser::ProcessTls: Should be overridden!')
return False
def ProcessRaw(self, data, domain):
self.LogError('TlsOrLineParser::ProcessRaw: Should be overridden!')
return False
class ChunkParser(Selectable):
\"\"\"A Selectable which parses the input as chunks.\"\"\"
def __init__(self, fd=None, address=None, on_port=None, ui=None):
Selectable.__init__(self, fd, address, on_port, ui=ui)
self.want_cbytes = 0
self.want_bytes = 0
self.compressed = False
self.header = ''
self.chunk = ''
self.zr = zlib.decompressobj()
def __html__(self):
return Selectable.__html__(self)
def Cleanup(self, close=True):
Selectable.Cleanup(self, close=close)
self.zr = self.chunk = self.header = None
def ProcessData(self, data):
if self.peeking:
self.want_cbytes = 0
self.want_bytes = 0
self.header = ''
self.chunk = ''
if self.want_bytes == 0:
self.header += data
if self.header.find('\\r\\n') < 0:
if self.read_eof: return self.ProcessEofRead()
return True
try:
size, data = self.header.split('\\r\\n', 1)
self.header = ''
if size.endswith('R'):
self.zr = zlib.decompressobj()
size = size[0:-1]
if 'Z' in size:
csize, zsize = size.split('Z')
self.compressed = True
self.want_cbytes = int(csize, 16)
self.want_bytes = int(zsize, 16)
else:
self.compressed = False
self.want_bytes = int(size, 16)
except ValueError, err:
self.LogError('ChunkParser::ProcessData: %s' % err)
self.Log([('bad_data', data)])
return False
if self.want_bytes == 0:
return False
process = data[:self.want_bytes]
leftover = data[self.want_bytes:]
self.chunk += process
self.want_bytes -= len(process)
result = 1
if self.want_bytes == 0:
if self.compressed:
try:
cchunk = self.zr.decompress(self.chunk)
except zlib.error:
cchunk = ''
if len(cchunk) != self.want_cbytes:
result = self.ProcessCorruptChunk(self.chunk)
else:
result = self.ProcessChunk(cchunk)
else:
result = self.ProcessChunk(self.chunk)
self.chunk = ''
if result and leftover:
# FIXME: This blows the stack from time to time. We need a loop
# or better yet, to just process more in a subsequent
# iteration of the main select() loop.
result = self.ProcessData(leftover)
if self.read_eof: result = self.ProcessEofRead() and result
return result
def ProcessCorruptChunk(self, chunk):
self.LogError('ChunkParser::ProcessData: ProcessCorruptChunk not overridden!')
return False
def ProcessChunk(self, chunk):
self.LogError('ChunkParser::ProcessData: ProcessChunk not overridden!')
return False
class Tunnel(ChunkParser):
\"\"\"A Selectable representing a PageKite tunnel.\"\"\"
S_NAME = 0
S_PORTS = 1
S_RAW_PORTS = 2
S_PROTOS = 3
def __init__(self, conns):
ChunkParser.__init__(self, ui=conns.config.ui)
# We want to be sure to read the entire chunk at once, including
# headers to save cycles, so we double the size we're willing to
# read here.
self.maxread *= 2
self.server_info = ['x.x.x.x:x', [], [], []]
self.conns = conns
self.users = {}
self.remote_ssl = {}
self.zhistory = {}
self.backends = {}
self.rtt = 100000
self.last_ping = 0
self.using_tls = False
def __html__(self):
return ('Server name: %s '
'%s') % (self.server_info[self.S_NAME], ChunkParser.__html__(self))
def _FrontEnd(conn, body, conns):
\"\"\"This is what the front-end does when a back-end requests a new tunnel.\"\"\"
self = Tunnel(conns)
requests = []
try:
for prefix in ('X-Beanstalk', 'X-PageKite'):
for feature in conn.parser.Header(prefix+'-Features'):
if not conns.config.disable_zchunks:
if feature == 'ZChunks': self.EnableZChunks(level=1)
# Track which versions we see in the wild.
version = 'old'
for v in conn.parser.Header(prefix+'-Version'): version = v
global gYamon
gYamon.vadd('version-%s' % version, 1, wrap=10000000)
for replace in conn.parser.Header(prefix+'-Replace'):
if replace in self.conns.conns_by_id:
repl = self.conns.conns_by_id[replace]
self.LogInfo('Disconnecting old tunnel: %s' % repl)
self.conns.Remove(repl)
repl.Cleanup()
for bs in conn.parser.Header(prefix):
# X-Beanstalk: proto:my.domain.com:token:signature
proto, domain, srand, token, sign = bs.split(':')
requests.append((proto.lower(), domain.lower(), srand, token, sign,
prefix))
except Exception, err:
self.LogError('Discarding connection: %s' % err)
self.Cleanup()
return None
except socket.error, err:
self.LogInfo('Discarding connection: %s' % err)
self.Cleanup()
return None
self.last_activity = time.time()
self.CountAs('backends_live')
self.SetConn(conn)
conns.auth.check(requests[:], conn, lambda r: self.AuthCallback(conn, r))
return self
def RecheckQuota(self, conns, when=None):
if when is None: when = time.time()
if (self.quota and
self.quota[0] is not None and
self.quota[1] and
(self.quota[2] < when-900)):
self.quota[2] = when
LogDebug('Rechecking: %s' % (self.quota, ))
conns.auth.check([self.quota[1]], self,
lambda r: self.QuotaCallback(conns, r))
def QuotaCallback(self, conns, results):
# Report new values to the back-end...
if self.quota and (self.quota[0] >= 0): self.SendQuota()
for r in results:
if r[0] in ('X-PageKite-OK', 'X-PageKite-Duplicate'):
return self
self.LogInfo('Ran out of quota or account deleted, closing tunnel.')
conns.Remove(self)
self.Cleanup()
return None
def AuthCallback(self, conn, results):
output = [HTTP_ResponseHeader(200, 'OK'),
HTTP_Header('Transfer-Encoding', 'chunked'),
HTTP_Header('X-PageKite-Protos', ', '.join(['%s' % p
for p in self.conns.config.server_protos])),
HTTP_Header('X-PageKite-Ports', ', '.join(
['%s' % self.conns.config.server_portalias.get(p, p)
for p in self.conns.config.server_ports]))]
if not self.conns.config.disable_zchunks:
output.append(HTTP_Header('X-PageKite-Features', 'ZChunks'))
if self.conns.config.server_raw_ports:
output.append(
HTTP_Header('X-PageKite-Raw-Ports',
', '.join(['%s' % p for p
in self.conns.config.server_raw_ports])))
ok = {}
for r in results:
if r[0] in ('X-PageKite-OK', 'X-Beanstalk-OK'): ok[r[1]] = 1
if r[0] == 'X-PageKite-SessionID': self.alt_id = r[1]
output.append('%s: %s\\r\\n' % r)
output.append(HTTP_StartBody())
if not self.Send(output, try_flush=True):
conn.LogDebug('No tunnels configured, closing connection (send failed).')
self.Cleanup()
return None
self.backends = ok.keys()
if self.backends:
for backend in self.backends:
proto, domain, srand = backend.split(':')
self.Log([('BE', 'Live'), ('proto', proto), ('domain', domain)])
self.conns.Tunnel(proto, domain, self)
if conn.quota:
self.quota = conn.quota
self.Log([('BE', 'Live'), ('quota', self.quota[0])])
self.conns.Add(self, alt_id=self.alt_id)
return self
else:
conn.LogDebug('No tunnels configured, closing connection.')
self.Cleanup()
return None
def _RecvHttpHeaders(self, fd=None):
data = ''
fd = fd or self.fd
while not data.endswith('\\r\\n\\r\\n') and not data.endswith('\\n\\n'):
try:
buf = fd.recv(1)
except:
# This is sloppy, but the back-end will just connect somewhere else
# instead, so laziness here should be fine.
buf = None
if buf is None or buf == '':
LogDebug('Remote end closed connection.')
return None
data += buf
self.read_bytes += len(buf)
if DEBUG_IO: print '<== IN (headers)\\n%s\\n===' % data
return data
def _Connect(self, server, conns, tokens=None):
if self.fd: self.fd.close()
sspec = server.split(':')
if len(sspec) < 2: sspec = (sspec[0], 443)
# Use chained SocksiPy to secure our communication.
socks.DEBUG = (DEBUG_IO or socks.DEBUG) and LogDebug
sock = socks.socksocket()
if socks.HAVE_SSL:
chain = ['default']
if self.conns.config.fe_anon_tls_wrap:
chain.append('ssl-anon:%s:%s' % (sspec[0], sspec[1]))
if self.conns.config.fe_certname:
chain.append('http:%s:%s' % (sspec[0], sspec[1]))
chain.append('ssl:%s:443' % ','.join(self.conns.config.fe_certname))
for hop in chain:
sock.addproxy(*socks.parseproxy(hop))
self.SetFD(sock)
try:
self.fd.settimeout(20.0) # Missing in Python 2.2
except Exception:
self.fd.setblocking(1)
self.fd.connect((sspec[0], int(sspec[1])))
replace_sessionid = self.conns.config.servers_sessionids.get(server, None)
if (not self.Send(HTTP_PageKiteRequest(server,
conns.config.backends,
tokens,
nozchunks=conns.config.disable_zchunks,
replace=replace_sessionid), try_flush=True)
or not self.Flush(wait=True)):
return None, None
data = self._RecvHttpHeaders()
if not data: return None, None
self.fd.setblocking(0)
parse = HttpLineParser(lines=data.splitlines(),
state=HttpLineParser.IN_RESPONSE)
return data, parse
def _BackEnd(server, backends, require_all, conns):
\"\"\"This is the back-end end of a tunnel.\"\"\"
self = Tunnel(conns)
self.backends = backends
self.require_all = require_all
self.server_info[self.S_NAME] = server
abort = True
try:
begin = time.time()
data, parse = self._Connect(server, conns)
if data and parse:
# Collect info about front-end capabilities, for interactive config
for portlist in parse.Header('X-PageKite-Ports'):
self.server_info[self.S_PORTS].extend(portlist.split(', '))
for portlist in parse.Header('X-PageKite-Raw-Ports'):
self.server_info[self.S_RAW_PORTS].extend(portlist.split(', '))
for protolist in parse.Header('X-PageKite-Protos'):
self.server_info[self.S_PROTOS].extend(protolist.split(', '))
for sessionid in parse.Header('X-PageKite-SessionID'):
self.alt_id = sessionid
conns.config.servers_sessionids[server] = sessionid
tryagain = False
tokens = {}
for request in parse.Header('X-PageKite-SignThis'):
proto, domain, srand, token = request.split(':')
tokens['%s:%s' % (proto, domain)] = token
tryagain = True
if tryagain:
begin = time.time()
data, parse = self._Connect(server, conns, tokens)
if data and parse:
sname = self.server_info[self.S_NAME]
conns.config.ui.NotifyServer(self, self.server_info)
for misc in parse.Header('X-PageKite-Misc'):
args = parse_qs(misc)
logdata = [('FE', sname)]
for arg in args:
logdata.append((arg, args[arg][0]))
Log(logdata)
if 'motd' in args and args['motd'][0]:
conns.config.ui.NotifyMOTD(sname, args['motd'][0])
for quota in parse.Header('X-PageKite-Quota'):
self.quota = [int(quota), None, None]
self.Log([('FE', sname), ('quota', quota)])
conns.config.ui.NotifyQuota(float(quota))
invalid_reasons = {}
for request in parse.Header('X-PageKite-Invalid-Why'):
# This is future-compatible, in that we can add more fields later.
details = request.split(';')
invalid_reasons[details[0]] = details[1]
for request in parse.Header('X-PageKite-Invalid'):
proto, domain, srand = request.split(':')
reason = invalid_reasons.get(request, 'unknown')
self.Log([('FE', sname),
('err', 'Rejected'),
('proto', proto),
('reason', reason),
('domain', domain)])
conns.config.ui.NotifyKiteRejected(proto, domain, reason, crit=True)
conns.config.SetBackendStatus(domain, proto,
add=BE_STATUS_ERR_TUNNEL)
for request in parse.Header('X-PageKite-Duplicate'):
abort = True
proto, domain, srand = request.split(':')
self.Log([('FE', self.server_info[self.S_NAME]),
('err', 'Duplicate'),
('proto', proto),
('domain', domain)])
conns.config.ui.NotifyKiteRejected(proto, domain, 'duplicate')
conns.config.SetBackendStatus(domain, proto,
add=BE_STATUS_ERR_TUNNEL)
if not conns.config.disable_zchunks:
for feature in parse.Header('X-PageKite-Features'):
if feature == 'ZChunks': self.EnableZChunks(level=9)
ssl_available = {}
for request in parse.Header('X-PageKite-SSL-OK'):
ssl_available[request] = True
for request in parse.Header('X-PageKite-OK'):
abort = False
proto, domain, srand = request.split(':')
conns.Tunnel(proto, domain, self)
status = BE_STATUS_OK
if request in ssl_available:
status |= BE_STATUS_REMOTE_SSL
self.remote_ssl[(proto, domain)] = True
self.Log([('FE', sname),
('proto', proto),
('domain', domain),
('ssl', (request in ssl_available))])
conns.config.SetBackendStatus(domain, proto, add=status)
self.rtt = (time.time() - begin)
except socket.error, e:
self.Cleanup()
return None
except Exception, e:
self.LogError('Server response parsing failed: %s' % e)
self.Cleanup()
return None
if abort: return None
conns.Add(self)
self.CountAs('frontends_live')
self.last_activity = time.time()
return self
FrontEnd = staticmethod(_FrontEnd)
BackEnd = staticmethod(_BackEnd)
def SendData(self, conn, data, sid=None, host=None, proto=None, port=None,
chunk_headers=None):
sid = int(sid or conn.sid)
if conn: self.users[sid] = conn
if not sid in self.zhistory: self.zhistory[sid] = [0, 0]
sending = ['SID: %s\\r\\n' % sid]
if proto: sending.append('Proto: %s\\r\\n' % proto)
if host: sending.append('Host: %s\\r\\n' % host)
if port:
porti = int(port)
if porti in self.conns.config.server_portalias:
sending.append('Port: %s\\r\\n' % self.conns.config.server_portalias[porti])
else:
sending.append('Port: %s\\r\\n' % port)
if chunk_headers:
for ch in chunk_headers: sending.append('%s: %s\\r\\n' % ch)
sending.append('\\r\\n')
sending.append(data)
return self.SendChunked(sending, zhistory=self.zhistory[sid])
def SendStreamEof(self, sid, write_eof=False, read_eof=False):
return self.SendChunked('SID: %s\\r\\nEOF: 1%s%s\\r\\n\\r\\nBye!' % (sid,
(write_eof or not read_eof) and 'W' or '',
(read_eof or not write_eof) and 'R' or ''))
def EofStream(self, sid, eof_type='WR'):
if sid in self.users and self.users[sid] is not None:
write_eof = (-1 != eof_type.find('W'))
read_eof = (-1 != eof_type.find('R'))
self.users[sid].ProcessTunnelEof(read_eof=(read_eof or not write_eof),
write_eof=(write_eof or not read_eof))
def CloseStream(self, sid, stream_closed=False):
if sid in self.users:
stream = self.users[sid]
del self.users[sid]
if not stream_closed and stream is not None:
stream.CloseTunnel(tunnel_closed=True)
if sid in self.zhistory:
del self.zhistory[sid]
def Cleanup(self, close=True):
if self.users:
for sid in self.users.keys(): self.CloseStream(sid)
ChunkParser.Cleanup(self, close=close)
self.conns = None
self.users = self.zhistory = self.backends = {}
def ResetRemoteZChunks(self):
return self.SendChunked('NOOP: 1\\r\\nZRST: 1\\r\\n\\r\\n!', compress=False)
def SendPing(self):
self.last_ping = int(time.time())
self.LogDebug(\"Ping\", [('host', self.server_info[self.S_NAME])])
return self.SendChunked('NOOP: 1\\r\\nPING: 1\\r\\n\\r\\n!', compress=False)
def SendPong(self):
return self.SendChunked('NOOP: 1\\r\\n\\r\\n!', compress=False)
def SendQuota(self):
return self.SendChunked('NOOP: 1\\r\\nQuota: %s\\r\\n\\r\\n!' % self.quota[0],
compress=False)
def SendThrottle(self, sid, write_speed):
return self.SendChunked('NOOP: 1\\r\\nSID: %s\\r\\nSPD: %d\\r\\n\\r\\n!' % (
sid, write_speed), compress=False)
def ProcessCorruptChunk(self, data):
self.ResetRemoteZChunks()
return True
def Probe(self, host):
for bid in self.conns.config.backends:
be = self.conns.config.backends[bid]
if be[BE_DOMAIN] == host:
bhost, bport = (be[BE_BHOST], be[BE_BPORT])
# FIXME: Should vary probe by backend type
if self.conns.config.Ping(bhost, int(bport)) > 2: return False
return True
def Throttle(self, parse):
try:
sid = int(parse.Header('SID')[0])
bps = int(parse.Header('SPD')[0])
if sid in self.users: self.users[sid].Throttle(bps, remote=True)
except Exception, e:
LogError('Tunnel::ProcessChunk: Invalid throttle request!')
return True
# If a tunnel goes down, we just go down hard and kill all our connections.
def ProcessEofRead(self):
if self.conns: self.conns.Remove(self)
self.Cleanup()
return True
def ProcessEofWrite(self):
return self.ProcessEofRead()
def ProcessChunk(self, data):
try:
headers, data = data.split('\\r\\n\\r\\n', 1)
parse = HttpLineParser(lines=headers.splitlines(),
state=HttpLineParser.IN_HEADERS)
except ValueError:
LogError('Tunnel::ProcessChunk: Corrupt packet!')
return False
try:
if parse.Header('Quota'):
if self.quota:
self.quota[0] = int(parse.Header('Quota')[0])
else:
self.quota = [int(parse.Header('Quota')[0]), None, None]
self.conns.config.ui.Notify(('You have %.2f MB of quota left.'
) % (float(self.quota[0]) / 1024),
color=self.conns.config.ui.MAGENTA)
if parse.Header('PING'): return self.SendPong()
if parse.Header('ZRST') and not self.ResetZChunks(): return False
if parse.Header('SPD') and not self.Throttle(parse): return False
if parse.Header('NOOP'): return True
except Exception, e:
LogError('Tunnel::ProcessChunk: Corrupt chunk: %s' % e)
return False
proto = conn = sid = None
try:
sid = int(parse.Header('SID')[0])
eof = parse.Header('EOF')
except IndexError, e:
LogError('Tunnel::ProcessChunk: Corrupt packet!')
return False
if eof:
self.EofStream(sid, eof[0])
else:
if sid in self.users:
conn = self.users[sid]
else:
proto = (parse.Header('Proto') or [''])[0].lower()
port = (parse.Header('Port') or [''])[0].lower()
host = (parse.Header('Host') or [''])[0].lower()
rIp = (parse.Header('RIP') or [''])[0].lower()
rPort = (parse.Header('RPort') or [''])[0].lower()
rTLS = (parse.Header('RTLS') or [''])[0].lower()
if proto and host:
# FIXME:
# if proto == 'https':
# if host in self.conns.config.tls_endpoints:
# print 'Should unwrap SSL from %s' % host
if proto == 'probe':
if self.conns.config.no_probes:
LogDebug('Responding to probe for %s: rejected' % host)
if not self.SendChunked('SID: %s\\r\\n\\r\\n%s' % (
sid, HTTP_NoFeConnection() )):
return False
elif self.Probe(host):
LogDebug('Responding to probe for %s: good' % host)
if not self.SendChunked('SID: %s\\r\\n\\r\\n%s' % (
sid, HTTP_GoodBeConnection() )):
return False
else:
LogDebug('Responding to probe for %s: back-end down' % host)
if not self.SendChunked('SID: %s\\r\\n\\r\\n%s' % (
sid, HTTP_NoBeConnection() )):
return False
else:
conn = UserConn.BackEnd(proto, host, sid, self, port,
remote_ip=rIp, remote_port=rPort, data=data)
if proto in ('http', 'http2', 'http3', 'websocket'):
if conn is None:
if not self.SendChunked('SID: %s\\r\\n\\r\\n%s' % (sid,
HTTP_Unavailable('be', proto, host,
frame_url=self.conns.config.error_url))):
return False
elif not conn:
if not self.SendChunked('SID: %s\\r\\n\\r\\n%s' % (sid,
HTTP_Unavailable('be', proto, host,
frame_url=self.conns.config.error_url,
code=401))):
return False
elif rIp:
add_headers = ('\\nX-Forwarded-For: %s\\r\\n'
'X-PageKite-Port: %s\\r\\n'
'X-PageKite-Proto: %s\\r\\n'
) % (rIp, port,
# FIXME: Checking for port == 443 is wrong!
((rTLS or (int(port) == 443)) and 'https'
or 'http'))
rewritehost = conn.config.get('rewritehost', False)
if rewritehost:
if rewritehost is True:
rewritehost = conn.backend[BE_BHOST]
for hdr in ('host', 'connection', 'keep-alive'):
data = re.sub(r'(?mi)^'+hdr, 'X-Old-'+hdr, data)
add_headers += ('Connection: close\\r\\n'
'Host: %s\\r\\n') % rewritehost
req, rest = re.sub(r'(?mi)^x-forwarded-for',
'X-Old-Forwarded-For', data).split('\\n', 1)
data = ''.join([req, add_headers, rest])
elif proto == 'httpfinger':
# Rewrite a finger request to HTTP.
try:
firstline, rest = data.split('\\n', 1)
if conn.config.get('rewritehost', False):
rewritehost = conn.backend[BE_BHOST]
else:
rewritehost = host
if '%s' in self.conns.config.finger_path:
args = (firstline.strip(), rIp, rewritehost, rest)
else:
args = (rIp, rewritehost, rest)
data = ('GET '+self.conns.config.finger_path+' HTTP/1.1\\r\\n'
'X-Forwarded-For: %s\\r\\n'
'Connection: close\\r\\n'
'Host: %s\\r\\n\\r\\n%s') % args
except Exception, e:
self.LogError('Error formatting HTTP-Finger: %s' % e)
conn = None
if conn:
self.users[sid] = conn
if proto == 'httpfinger':
conn.fd.setblocking(1)
conn.Send(data, try_flush=True) or conn.Flush(wait=True)
self._RecvHttpHeaders(fd=conn.fd)
conn.fd.setblocking(0)
data = ''
if not conn:
self.CloseStream(sid)
if not self.SendStreamEof(sid): return False
else:
if not conn.Send(data, try_flush=True):
# FIXME
pass
if len(conn.write_blocked) > 2*max(conn.write_speed, 50000):
if conn.created < time.time()-3:
if not self.SendThrottle(sid, conn.write_speed): return False
return True
class LoopbackTunnel(Tunnel):
\"\"\"A Tunnel which just loops back to this process.\"\"\"
def __init__(self, conns, which, backends):
Tunnel.__init__(self, conns)
self.backends = backends
self.require_all = True
self.server_info[self.S_NAME] = LOOPBACK[which]
self.other_end = None
if which == 'FE':
for d in backends.keys():
if backends[d][BE_BHOST]:
proto, domain = d.split(':')
self.conns.Tunnel(proto, domain, self)
self.Log([('FE', self.server_info[self.S_NAME]),
('proto', proto),
('domain', domain)])
def Cleanup(self, close=True):
Tunnel.Cleanup(self, close=close)
other = self.other_end
self.other_end = None
if other and other.other_end: other.Cleanup()
def Linkup(self, other):
self.other_end = other
other.other_end = self
def _Loop(conns, backends):
return LoopbackTunnel(conns, 'FE', backends
).Linkup(LoopbackTunnel(conns, 'BE', backends))
Loop = staticmethod(_Loop)
def Send(self, data):
return self.other_end.ProcessData(''.join(data))
class UserConn(Selectable):
\"\"\"A Selectable representing a user's connection.\"\"\"
def __init__(self, address, ui=None):
Selectable.__init__(self, address=address, ui=ui)
self.tunnel = None
self.conns = None
self.backend = BE_NONE[:]
self.config = {}
# UserConn objects are considered active immediately
self.last_activity = time.time()
def __html__(self):
return ('Tunnel: %s '
'%s') % (self.tunnel and self.tunnel.sid or '',
escape_html('%s' % (self.tunnel or '')),
Selectable.__html__(self))
def CloseTunnel(self, tunnel_closed=False):
tunnel = self.tunnel
self.tunnel = None
if tunnel and not tunnel_closed:
if not self.read_eof or not self.write_eof:
tunnel.SendStreamEof(self.sid, write_eof=True, read_eof=True)
tunnel.CloseStream(self.sid, stream_closed=True)
self.ProcessTunnelEof(read_eof=True, write_eof=True)
def Cleanup(self, close=True):
if close:
self.CloseTunnel()
Selectable.Cleanup(self, close=close)
if self.conns:
self.conns.Remove(self)
self.backend = self.config = self.conns = None
def _FrontEnd(conn, address, proto, host, on_port, body, conns):
# This is when an external user connects to a server and requests a
# web-page. We have to give it to them!
self = UserConn(address, ui=conns.config.ui)
self.conns = conns
self.SetConn(conn)
if ':' in host: host, port = host.split(':', 1)
self.proto = proto
self.host = host
# If the listening port is an alias for another...
if int(on_port) in conns.config.server_portalias:
on_port = conns.config.server_portalias[int(on_port)]
# Try and find the right tunnel. We prefer proto/port specifications first,
# then the just the proto. If the protocol is WebSocket and no tunnel is
# found, look for a plain HTTP tunnel.
if proto == 'probe':
protos = ['http', 'https', 'websocket', 'raw', 'irc',
'finger', 'httpfinger']
ports = conns.config.server_ports[:]
ports.extend(conns.config.server_aliasport.keys())
ports.extend([x for x in conns.config.server_raw_ports if x != VIRTUAL_PN])
else:
protos = [proto]
ports = [on_port]
if proto == 'websocket': protos.append('http')
elif proto == 'http': protos.extend(['http2', 'http3'])
tunnels = None
for p in protos:
for prt in ports:
if not tunnels: tunnels = conns.Tunnel('%s-%s' % (p, prt), host)
if not tunnels: tunnels = conns.Tunnel(p, host)
if not tunnels: tunnels = conns.Tunnel(protos[0], CATCHALL_HN)
if self.address:
chunk_headers = [('RIP', self.address[0]), ('RPort', self.address[1])]
if conn.my_tls: chunk_headers.append(('RTLS', 1))
if tunnels: self.tunnel = tunnels[0]
if (self.tunnel and self.tunnel.SendData(self, ''.join(body), host=host,
proto=proto, port=on_port,
chunk_headers=chunk_headers)
and self.conns):
self.Log([('domain', self.host), ('on_port', on_port), ('proto', self.proto), ('is', 'FE')])
self.conns.Add(self)
if proto.startswith('http'):
self.conns.TrackIP(address[0], host)
# FIXME: Use the tracked data to detect & mitigate abuse?
return self
else:
self.LogDebug('No back-end', [('on_port', on_port), ('proto', self.proto),
('domain', self.host), ('is', 'FE')])
self.Cleanup(close=False)
return None
def _BackEnd(proto, host, sid, tunnel, on_port,
remote_ip=None, remote_port=None, data=None):
# This is when we open a backend connection, because a user asked for it.
self = UserConn(None, ui=tunnel.conns.config.ui)
self.sid = sid
self.proto = proto
self.host = host
self.conns = tunnel.conns
self.tunnel = tunnel
failure = None
# Try and find the right back-end. We prefer proto/port specifications
# first, then the just the proto. If the protocol is WebSocket and no
# tunnel is found, look for a plain HTTP tunnel. Fallback hosts can
# be registered using the http2/3/4 protocols.
backend = None
if proto == 'http': protos = [proto, 'http2', 'http3']
elif proto == 'probe': protos = ['http', 'http2', 'http3']
elif proto == 'websocket': protos = [proto, 'http', 'http2', 'http3']
else: protos = [proto]
for p in protos:
if not backend: backend, be = self.conns.config.GetBackendServer('%s-%s' % (p, on_port), host)
if not backend: backend, be = self.conns.config.GetBackendServer(p, host)
if not backend: backend, be = self.conns.config.GetBackendServer(p, CATCHALL_HN)
logInfo = [
('on_port', on_port),
('proto', proto),
('domain', host),
('is', 'BE')
]
if remote_ip: logInfo.append(('remote_ip', remote_ip))
# Strip off useless IPv6 prefix, if this is an IPv4 address.
if remote_ip.startswith('::ffff:') and ':' not in remote_ip[7:]:
remote_ip = remote_ip[7:]
if not backend or not backend[0]:
self.ui.Notify(('%s - %s://%s:%s (FAIL: no server)'
) % (remote_ip or 'unknown', proto, host, on_port),
prefix='?', color=self.ui.YELLOW)
else:
http_host = '%s/%s' % (be[BE_DOMAIN], be[BE_PORT] or '80')
self.backend = be
self.config = host_config = self.conns.config.be_config.get(http_host, {})
# Access control interception: check remote IP addresses first.
ip_keys = [k for k in host_config if k.startswith('ip/')]
if ip_keys:
k1 = 'ip/%s' % remote_ip
k2 = '.'.join(k1.split('.')[:-1])
if not (k1 in host_config or k2 in host_config):
self.ui.Notify(('%s - %s://%s:%s (IP ACCESS DENIED)'
) % (remote_ip or 'unknown', proto, host, on_port),
prefix='!', color=self.ui.YELLOW)
logInfo.append(('forbidden-ip', '%s' % remote_ip))
backend = None
# Access control interception: check for HTTP Basic authentication.
user_keys = [k for k in host_config if k.startswith('password/')]
if user_keys:
user, pwd, fail = None, None, True
if proto in ('websocket', 'http', 'http2', 'http3'):
parse = HttpLineParser(lines=data.splitlines())
auth = parse.Header('Authorization')
try:
(how, ab64) = auth[0].strip().split()
if how.lower() == 'basic':
user, pwd = base64.decodestring(ab64).split(':')
except:
user = auth
user_key = 'password/%s' % user
if user and user_key in host_config:
if host_config[user_key] == pwd:
fail = False
if fail:
if DEBUG_IO: print '=== REQUEST\\n%s\\n===' % data
self.ui.Notify(('%s - %s://%s:%s (USER ACCESS DENIED)'
) % (remote_ip or 'unknown', proto, host, on_port),
prefix='!', color=self.ui.YELLOW)
logInfo.append(('forbidden-user', '%s' % user))
backend = None
failure = ''
if not backend:
logInfo.append(('err', 'No back-end'))
self.Log(logInfo)
self.Cleanup(close=False)
return failure
try:
self.SetFD(rawsocket(socket.AF_INET, socket.SOCK_STREAM))
try:
self.fd.settimeout(2.0) # Missing in Python 2.2
except Exception:
self.fd.setblocking(1)
sspec = list(backend)
if len(sspec) == 1: sspec.append(80)
self.fd.connect(tuple(sspec))
self.fd.setblocking(0)
except socket.error, err:
logInfo.append(('socket_error', '%s' % err))
self.ui.Notify(('%s - %s://%s:%s (FAIL: %s:%s is down)'
) % (remote_ip or 'unknown', proto, host, on_port,
sspec[0], sspec[1]),
prefix='!', color=self.ui.YELLOW)
self.Log(logInfo)
self.Cleanup(close=False)
return None
sspec = (sspec[0], sspec[1])
be_name = (sspec == self.conns.config.ui_sspec) and 'builtin' or ('%s:%s' % sspec)
self.ui.Status('serving')
self.ui.Notify(('%s < %s://%s:%s (%s)'
) % (remote_ip or 'unknown', proto, host, on_port, be_name))
self.Log(logInfo)
self.conns.Add(self)
return self
FrontEnd = staticmethod(_FrontEnd)
BackEnd = staticmethod(_BackEnd)
def Shutdown(self, direction):
try:
if self.fd:
if 'sock_shutdown' in dir(self.fd):
# This is a pyOpenSSL socket, which has incompatible shutdown.
if direction == socket.SHUT_RD:
self.fd.shutdown()
else:
self.fd.sock_shutdown(direction)
else:
self.fd.shutdown(direction)
except Exception, e:
pass
def ProcessTunnelEof(self, read_eof=False, write_eof=False):
if read_eof and not self.write_eof:
self.ProcessEofWrite(tell_tunnel=False)
if write_eof and not self.read_eof:
self.ProcessEofRead(tell_tunnel=False)
return True
def ProcessEofRead(self, tell_tunnel=True):
self.read_eof = True
self.Shutdown(socket.SHUT_RD)
if tell_tunnel and self.tunnel:
self.tunnel.SendStreamEof(self.sid, read_eof=True)
return self.ProcessEof()
def ProcessEofWrite(self, tell_tunnel=True):
self.write_eof = True
if not self.write_blocked: self.Shutdown(socket.SHUT_WR)
if tell_tunnel and self.tunnel:
self.tunnel.SendStreamEof(self.sid, write_eof=True)
return self.ProcessEof()
def Send(self, data, try_flush=False):
rv = Selectable.Send(self, data, try_flush=try_flush)
if self.write_eof and not self.write_blocked:
self.Shutdown(socket.SHUT_WR)
return rv
def ProcessData(self, data):
if not self.tunnel:
self.LogError('No tunnel! %s' % self)
return False
if not self.tunnel.SendData(self, data):
self.LogDebug('Send to tunnel failed')
return False
# Back off if tunnel is stuffed.
if self.tunnel and len(self.tunnel.write_blocked) > 1024000:
self.Throttle(delay=(len(self.tunnel.write_blocked)-204800)/max(50000, self.tunnel.write_speed))
if self.read_eof: return self.ProcessEofRead()
return True
class UnknownConn(MagicProtocolParser):
\"\"\"This class is a connection which we're not sure what is yet.\"\"\"
def __init__(self, fd, address, on_port, conns):
MagicProtocolParser.__init__(self, fd, address, on_port, ui=conns.config.ui)
self.peeking = True
# Set up our parser chain.
self.parsers = [HttpLineParser]
if IrcLineParser.PROTO in conns.config.server_protos:
self.parsers.append(IrcLineParser)
if FingerLineParser.PROTO in conns.config.server_protos:
self.parsers.append(FingerLineParser)
self.parser = MagicLineParser(parsers=self.parsers)
self.conns = conns
self.conns.Add(self)
self.sid = -1
self.host = None
self.proto = None
self.said_hello = False
def Cleanup(self, close=True):
if self.conns: self.conns.Remove(self)
MagicProtocolParser.Cleanup(self, close=close)
self.conns = self.parser = None
def SayHello(self):
if self.said_hello:
return
else:
self.said_hello = True
if self.on_port in (25, 125, ):
# FIXME: We don't actually support SMTP yet and 125 is bogus.
self.Send(['220 ready ESMTP PageKite Magic Proxy\\n'], try_flush=True)
def __str__(self):
return '%s (%s/%s:%s)' % (MagicProtocolParser.__str__(self),
(self.proto or '?'),
(self.on_port or '?'),
(self.host or '?'))
def ProcessEofRead(self):
self.read_eof = True
return self.ProcessEof()
def ProcessEofWrite(self):
self.read_eof = True
return self.ProcessEof()
def ProcessLine(self, line, lines):
if not self.parser: return True
if self.parser.Parse(line) is False: return False
if not self.parser.ParsedOK(): return True
self.parser = self.parser.last_parser
if self.parser.protocol == HttpLineParser.PROTO:
# HTTP has special cases, including CONNECT etc.
return self.ProcessParsedHttp(line, lines)
else:
return self.ProcessParsedMagic(self.parser.PROTOS, line, lines)
def ProcessParsedMagic(self, protos, line, lines):
for proto in protos:
if UserConn.FrontEnd(self, self.address,
proto, self.parser.domain, self.on_port,
self.parser.lines + lines, self.conns) is not None:
self.Cleanup(close=False)
return True
self.Send([self.parser.ErrorReply(port=self.on_port)], try_flush=True)
self.Cleanup()
return False
def ProcessParsedHttp(self, line, lines):
done = False
if self.parser.method == 'PING':
self.Send('PONG %s\\r\\n\\r\\n' % self.parser.path)
self.read_eof = self.write_eof = done = True
self.fd.close()
elif self.parser.method == 'CONNECT':
if self.parser.path.lower().startswith('pagekite:'):
if Tunnel.FrontEnd(self, lines, self.conns) is None: return False
done = True
else:
try:
connect_parser = self.parser
chost, cport = connect_parser.path.split(':', 1)
cport = int(cport)
chost = chost.lower()
sid1 = ':%s' % chost
sid2 = '-%s:%s' % (cport, chost)
tunnels = self.conns.tunnels
# These allow explicit CONNECTs to direct http(s) or raw backends.
# If no match is found, we fall through to default HTTP processing.
if cport in (80, 8080):
if (('http'+sid1) in tunnels) or (
('http'+sid2) in tunnels) or (
('http2'+sid1) in tunnels) or (
('http2'+sid2) in tunnels) or (
('http3'+sid1) in tunnels) or (
('http3'+sid2) in tunnels):
(self.on_port, self.host) = (cport, chost)
self.parser = HttpLineParser()
self.Send(HTTP_ConnectOK(), try_flush=True)
return True
whost = chost
if '.' in whost:
whost = '*.' + '.'.join(whost.split('.')[1:])
if cport == 443:
if (('https'+sid1) in tunnels) or (
('https'+sid2) in tunnels) or (
chost in self.conns.config.tls_endpoints) or (
whost in self.conns.config.tls_endpoints):
(self.on_port, self.host) = (cport, chost)
self.parser = HttpLineParser()
self.Send(HTTP_ConnectOK(), try_flush=True)
return self.ProcessTls(''.join(lines), chost)
if (cport in self.conns.config.server_raw_ports or
VIRTUAL_PN in self.conns.config.server_raw_ports):
for raw in ('raw', 'finger'):
if ((raw+sid1) in tunnels) or ((raw+sid2) in tunnels):
(self.on_port, self.host) = (cport, chost)
self.parser = HttpLineParser()
self.Send(HTTP_ConnectOK(), try_flush=True)
return self.ProcessRaw(''.join(lines), self.host)
except ValueError:
pass
if (not done and self.parser.method == 'POST'
and self.parser.path in MAGIC_PATHS):
# FIXME: DEPRECATE: Make this go away!
if Tunnel.FrontEnd(self, lines, self.conns) is None: return False
done = True
if not done:
if not self.host:
hosts = self.parser.Header('Host')
if hosts:
self.host = hosts[0].lower()
else:
self.Send(HTTP_Response(400, 'Bad request',
['
400 Bad request
',
'
Invalid request, no Host: found.
',
'']))
return False
if self.parser.path.startswith(MAGIC_PREFIX):
try:
self.host = self.parser.path.split('/')[2]
self.proto = 'probe'
except ValueError:
pass
if self.proto is None:
self.proto = 'http'
upgrade = self.parser.Header('Upgrade')
if 'websocket' in self.conns.config.server_protos:
if upgrade and upgrade[0].lower() == 'websocket':
self.proto = 'websocket'
address = self.address
if int(self.on_port) in self.conns.config.server_portalias:
xfwdf = self.parser.Header('X-Forwarded-For')
if xfwdf and address[0] == '127.0.0.1':
address = (xfwdf[0], address[1])
done = True
if UserConn.FrontEnd(self, address,
self.proto, self.host, self.on_port,
self.parser.lines + lines, self.conns) is None:
if self.proto == 'probe':
self.Send(HTTP_NoFeConnection(),
try_flush=True)
else:
self.Send(HTTP_Unavailable('fe', self.proto, self.host,
frame_url=self.conns.config.error_url),
try_flush=True)
return False
# We are done!
self.Cleanup(close=False)
return True
def ProcessTls(self, data, domain=None):
if domain:
domains = [domain]
else:
try:
domains = self.GetSni(data)
if not domains:
domains = [self.conns.LastIpDomain(self.address[0]) or self.conns.config.tls_default]
LogDebug('No SNI - trying: %s' % domains[0])
if not domains[0]: domains = None
except Exception:
# Probably insufficient data, just return True and assume we'll have
# better luck on the next round.
return True
if domains and domains[0] is not None:
if UserConn.FrontEnd(self, self.address,
'https', domains[0], self.on_port,
[data], self.conns) is not None:
# We are done!
self.EatPeeked()
self.Cleanup(close=False)
return True
else:
# If we know how to terminate the TLS/SSL, do so!
ctx = self.conns.config.GetTlsEndpointCtx(domains[0])
if ctx:
self.fd = socks.SSL_Connect(ctx, self.fd,
accepted=True, server_side=True)
self.peeking = False
self.is_tls = False
self.my_tls = True
return True
else:
return False
return False
def ProcessRaw(self, data, domain):
if UserConn.FrontEnd(self, self.address,
'raw', domain, self.on_port,
[data], self.conns) is None:
return False
# We are done!
self.Cleanup(close=False)
return True
class UiConn(LineParser):
STATE_PASSWORD = 0
STATE_LIVE = 1
def __init__(self, fd, address, on_port, conns):
LineParser.__init__(self, fd=fd, address=address, on_port=on_port)
self.state = self.STATE_PASSWORD
self.conns = conns
self.conns.Add(self)
self.lines = []
self.qc = threading.Condition()
self.challenge = sha1hex('%s%8.8x' % (globalSecret(),
random.randint(0, 0x7FFFFFFD)+1))
self.expect = signToken(token=self.challenge,
secret=self.conns.config.ConfigSecret(),
payload=self.challenge,
length=1000)
LogDebug('Expecting: %s' % self.expect)
self.Send('PageKite? %s\\r\\n' % self.challenge)
def readline(self):
self.qc.acquire()
while not self.lines: self.qc.wait()
line = self.lines.pop(0)
self.qc.release()
return line
def write(self, data):
self.conns.config.ui_wfile.write(data)
self.Send(data)
def Cleanup(self):
self.conns.config.ui.wfile = self.conns.config.ui_wfile
self.conns.config.ui.rfile = self.conns.config.ui_rfile
self.lines = self.conns.config.ui_conn = None
self.conns = None
LineParser.Cleanup(self)
def Disconnect(self):
self.Send('Goodbye')
self.Cleanup()
def ProcessLine(self, line, lines):
if self.state == self.STATE_LIVE:
self.qc.acquire()
self.lines.append(line)
self.qc.notify()
self.qc.release()
return True
elif self.state == self.STATE_PASSWORD:
if line.strip() == self.expect:
if self.conns.config.ui_conn: self.conns.config.ui_conn.Disconnect()
self.conns.config.ui_conn = self
self.conns.config.ui.wfile = self
self.conns.config.ui.rfile = self
self.state = self.STATE_LIVE
self.Send('OK!\\r\\n')
return True
else:
self.Send('Sorry.\\r\\n')
return False
else:
return False
class RawConn(Selectable):
\"\"\"This class is a raw/timed connection.\"\"\"
def __init__(self, fd, address, on_port, conns):
Selectable.__init__(self, fd, address, on_port)
self.my_tls = False
self.is_tls = False
domain = conns.LastIpDomain(address[0])
if domain and UserConn.FrontEnd(self, address, 'raw', domain, on_port,
[], conns):
self.Cleanup(close=False)
else:
self.Cleanup()
class Listener(Selectable):
\"\"\"This class listens for incoming connections and accepts them.\"\"\"
def __init__(self, host, port, conns, backlog=100,
connclass=UnknownConn, quiet=False):
Selectable.__init__(self, bind=(host, port), backlog=backlog)
self.Log([('listen', '%s:%s' % (host, port))])
if not quiet:
conns.config.ui.Notify(' - Listening on %s:%s' % (host or '*', port))
self.connclass = connclass
self.port = port
self.last_activity = self.created + 1
self.conns = conns
self.conns.Add(self)
def __str__(self):
return '%s port=%s' % (Selectable.__str__(self), self.port)
def __html__(self):
return '
Listening on port %s for %s
' % (self.port, self.connclass)
def ReadData(self, maxread=None):
try:
client, address = self.fd.accept()
if client:
self.Log([('accept', '%s:%s' % (obfuIp(address[0]), address[1]))])
uc = self.connclass(client, address, self.port, self.conns)
return True
except IOError, err:
if err.errno in self.HARMLESS_ERRNOS:
return True
else:
self.LogDebug('Listener::ReadData: error: %s (%s)' % (err, err.errno))
except socket.error, (errno, msg):
if errno in self.HARMLESS_ERRNOS:
return True
else:
self.LogInfo('Listener::ReadData: error: %s (errno=%s)' % (msg, errno))
except Exception, e:
LogDebug('Listener::ReadData: %s' % e)
return False
class HttpUiThread(threading.Thread):
\"\"\"Handle HTTP UI in a separate thread.\"\"\"
daemon = True
def __init__(self, pkite, conns,
server=None, handler=None, ssl_pem_filename=None):
threading.Thread.__init__(self)
if not (server and handler):
self.serve = False
self.httpd = None
return
self.ui_sspec = pkite.ui_sspec
self.httpd = server(self.ui_sspec, pkite, conns,
handler=handler,
ssl_pem_filename=ssl_pem_filename)
self.httpd.socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
self.ui_sspec = pkite.ui_sspec = (self.ui_sspec[0],
self.httpd.socket.getsockname()[1])
self.serve = True
def quit(self):
self.serve = False
try:
knock = rawsocket(socket.AF_INET, socket.SOCK_STREAM)
knock.connect(self.ui_sspec)
knock.close()
except IOError:
pass
try:
self.join()
except RuntimeError:
try:
if self.httpd and self.httpd.socket:
self.httpd.socket.close()
except IOError:
pass
def run(self):
while self.serve:
try:
self.httpd.handle_request()
except KeyboardInterrupt:
self.serve = False
except Exception, e:
LogInfo('HTTP UI caught exception: %s' % e)
if self.httpd: self.httpd.socket.close()
LogDebug('HttpUiThread: done')
class UiCommunicator(threading.Thread):
\"\"\"Listen for interactive commands.\"\"\"
def __init__(self, config, conns):
threading.Thread.__init__(self)
self.looping = False
self.config = config
self.conns = conns
LogDebug('UiComm: Created')
def run(self):
self.looping = True
while self.looping:
if not self.config or not self.config.ui.ALLOWS_INPUT:
time.sleep(1)
continue
line = ''
try:
i, o, e = select.select([self.config.ui.rfile], [], [], 1)
if not i: continue
except:
pass
if self.config:
line = self.config.ui.rfile.readline().strip()
if line: self.Parse(line)
LogDebug('UiCommunicator: done')
def Reconnect(self):
if self.config.tunnel_manager:
self.config.ui.Status('reconfig')
self.config.tunnel_manager.CloseTunnels()
self.config.tunnel_manager.HurryUp()
def Parse(self, line):
try:
command, args = line.split(': ', 1)
LogDebug('UiComm: %s(%s)' % (command, args))
if args.lower() == 'none': args = None
elif args.lower() == 'true': args = True
elif args.lower() == 'false': args = False
if command == 'exit':
self.config.keep_looping = False
self.config.main_loop = False
elif command == 'restart':
self.config.keep_looping = False
self.config.main_loop = True
elif command == 'config':
command = 'change settings'
self.config.Configure(['--%s' % args])
elif command == 'enablekite':
command = 'enable kite'
if args and args in self.config.backends:
self.config.backends[args][BE_STATUS] = BE_STATUS_UNKNOWN
self.Reconnect()
else:
raise Exception('No such kite: %s' % args)
elif command == 'disablekite':
command = 'disable kite'
if args and args in self.config.backends:
self.config.backends[args][BE_STATUS] = BE_STATUS_DISABLED
self.Reconnect()
else:
raise Exception('No such kite: %s' % args)
elif command == 'delkite':
command = 'remove kite'
if args and args in self.config.backends:
del self.config.backends[args]
self.Reconnect()
else:
raise Exception('No such kite: %s' % args)
elif command == 'addkite':
command = 'create new kite'
args = (args or '').strip().split() or ['']
if self.config.RegisterNewKite(kitename=args[0],
autoconfigure=True, ask_be=True):
self.Reconnect()
elif command == 'save':
command = 'save configuration'
self.config.SaveUserConfig(quiet=(args == 'quietly'))
except ValueError:
LogDebug('UiComm: bogus: %s' % line)
except SystemExit:
self.config.keep_looping = False
self.config.main_loop = False
except:
LogDebug('UiComm: %s' % (sys.exc_info(), ))
self.config.ui.Tell(['Oops!', '', 'Failed to %s, details:' % command,
'', '%s' % (sys.exc_info(), )], error=True)
def quit(self):
self.looping = False
self.conns = None
try:
self.join()
except RuntimeError:
pass
class TunnelManager(threading.Thread):
\"\"\"Create new tunnels as necessary or kill idle ones.\"\"\"
daemon = True
def __init__(self, pkite, conns):
threading.Thread.__init__(self)
self.pkite = pkite
self.conns = conns
def CheckIdleConns(self, now):
active = []
for conn in self.conns.idle:
if conn.last_activity:
active.append(conn)
elif conn.created < now - 10:
LogDebug('Removing idle connection: %s' % conn)
self.conns.Remove(conn)
conn.Cleanup()
elif conn.created < now - 1:
conn.SayHello()
for conn in active:
self.conns.idle.remove(conn)
def CheckTunnelQuotas(self, now):
for tid in self.conns.tunnels:
for tunnel in self.conns.tunnels[tid]:
tunnel.RecheckQuota(self.conns, when=now)
def PingTunnels(self, now):
dead = {}
for tid in self.conns.tunnels:
for tunnel in self.conns.tunnels[tid]:
grace = max(40, len(tunnel.write_blocked)/(tunnel.write_speed or 0.001))
if tunnel.last_activity == 0:
pass
elif tunnel.last_activity < tunnel.last_ping-(5+grace):
dead['%s' % tunnel] = tunnel
elif tunnel.last_activity < now-30 and tunnel.last_ping < now-2:
tunnel.SendPing()
for tunnel in dead.values():
Log([('dead', tunnel.server_info[tunnel.S_NAME])])
self.conns.Remove(tunnel)
tunnel.Cleanup()
def CloseTunnels(self):
close = []
for tid in self.conns.tunnels:
for tunnel in self.conns.tunnels[tid]:
close.append(tunnel)
for tunnel in close:
Log([('closing', tunnel.server_info[tunnel.S_NAME])])
self.conns.Remove(tunnel)
tunnel.Cleanup()
def quit(self):
self.keep_running = False
def run(self):
self.keep_running = True
self.explained = False
while self.keep_running:
try:
self._run()
except Exception, e:
LogError('TunnelManager died: %s' % e)
if DEBUG_IO: traceback.print_exc(file=sys.stderr)
time.sleep(5)
LogDebug('TunnelManager: done')
def _run(self):
self.check_interval = 5
while self.keep_running:
# Reconnect if necessary, randomized exponential fallback.
problem = False
if self.pkite.CreateTunnels(self.conns) > 0:
self.check_interval += int(1+random.random()*self.check_interval)
if self.check_interval > 300: self.check_interval = 300
problem = True
time.sleep(1)
else:
self.check_interval = 5
# If all connected, make sure tunnels are really alive.
if self.pkite.isfrontend:
self.CheckTunnelQuotas(time.time())
# FIXME: Front-ends should close dead back-end tunnels.
for tid in self.conns.tunnels:
proto, domain = tid.split(':')
if '-' in proto:
proto, port = proto.split('-')
else:
port = ''
self.pkite.ui.NotifyFlyingFE(proto, port, domain)
self.PingTunnels(time.time())
self.pkite.ui.StartListingBackEnds()
for bid in self.pkite.backends:
be = self.pkite.backends[bid]
# Do we have auto-SSL at the front-end?
protoport, domain = bid.split(':', 1)
tunnels = self.conns.Tunnel(protoport, domain)
if be[BE_PROTO] in ('http', 'http2', 'http3') and tunnels:
has_ssl = True
for t in tunnels:
if (protoport, domain) not in t.remote_ssl: has_ssl = False
else:
has_ssl = False
# Get list of webpaths...
domainp = '%s/%s' % (domain, be[BE_PORT] or '80')
if (self.pkite.ui_sspec and
be[BE_BHOST] == self.pkite.ui_sspec[0] and
be[BE_BPORT] == self.pkite.ui_sspec[1]):
builtin = True
dpaths = self.pkite.ui_paths.get(domainp, {})
else:
builtin = False
dpaths = {}
self.pkite.ui.NotifyBE(bid, be, has_ssl, dpaths, is_builtin=builtin)
self.pkite.ui.EndListingBackEnds()
if self.pkite.isfrontend:
self.pkite.LoadMOTD()
tunnel_count = len(self.pkite.conns and
self.pkite.conns.TunnelServers() or [])
tunnel_total = len(self.pkite.servers)
if tunnel_count == 0:
if self.pkite.isfrontend:
self.pkite.ui.Status('idle', message='Waiting for back-ends.')
elif tunnel_total == 0:
self.pkite.ui.Status('down', color=self.pkite.ui.GREY,
message='No kites ready to fly. Boring...')
else:
self.pkite.ui.Status('down', color=self.pkite.ui.RED,
message='Not connected to any front-ends, will retry...')
elif tunnel_count < tunnel_total:
self.pkite.ui.Status('flying', color=self.pkite.ui.YELLOW,
message=('Only connected to %d/%d front-ends, will retry...'
) % (tunnel_count, tunnel_total))
elif problem:
self.pkite.ui.Status('flying', color=self.pkite.ui.YELLOW,
message='DynDNS updates may be incomplete, will retry...')
else:
self.pkite.ui.Status('flying', color=self.pkite.ui.GREEN,
message='Kites are flying and all is well.')
for i in xrange(0, self.check_interval):
if self.keep_running:
time.sleep(1)
if i > self.check_interval: break
if self.pkite.isfrontend:
self.CheckIdleConns(time.time())
def HurryUp(self):
self.check_interval = 0
class NullUi(object):
\"\"\"This is a UI that always returns default values or raises errors.\"\"\"
DAEMON_FRIENDLY = True
ALLOWS_INPUT = False
WANTS_STDERR = False
REJECTED_REASONS = {
'quota': 'You are out of quota',
'nodays': 'Your subscription has expired',
'noquota': 'You are out of quota',
'noconns': 'You are flying too many kites',
'unauthorized': 'Invalid account or shared secret'
}
def __init__(self, welcome=None, wfile=sys.stderr, rfile=sys.stdin):
if sys.platform in ('win32', 'os2', 'os2emx'):
self.CLEAR = '\\n\\n'
self.NORM = self.WHITE = self.GREY = self.GREEN = self.YELLOW = ''
self.BLUE = self.RED = self.MAGENTA = self.CYAN = ''
else:
self.CLEAR = '\\033[H\\033[J'
self.NORM = '\\033[0m'
self.WHITE = '\\033[1m'
self.GREY = '\\033[0m' #'\\033[30;1m'
self.RED = '\\033[31;1m'
self.GREEN = '\\033[32;1m'
self.YELLOW = '\\033[33;1m'
self.BLUE = '\\033[34;1m'
self.MAGENTA = '\\033[35;1m'
self.CYAN = '\\033[36;1m'
self.wfile = wfile
self.rfile = rfile
self.in_wizard = False
self.wizard_tell = None
self.last_tick = 0
self.notify_history = {}
self.status_tag = ''
self.status_col = self.NORM
self.status_msg = ''
self.welcome = welcome
self.tries = 200
self.server_info = None
self.Splash()
def Splash(self): pass
def Welcome(self): pass
def StartWizard(self, title): pass
def EndWizard(self): pass
def Spacer(self): pass
def Browse(self, url):
import webbrowser
self.Tell(['Opening %s in your browser...' % url])
webbrowser.open(url)
def DefaultOrFail(self, question, default):
if default is not None: return default
raise ConfigError('Unanswerable question: %s' % question)
def AskLogin(self, question, default=None, email=None,
wizard_hint=False, image=None, back=None):
return self.DefaultOrFail(question, default)
def AskEmail(self, question, default=None, pre=None,
wizard_hint=False, image=None, back=None):
return self.DefaultOrFail(question, default)
def AskYesNo(self, question, default=None, pre=None, yes='Yes', no='No',
wizard_hint=False, image=None, back=None):
return self.DefaultOrFail(question, default)
def AskKiteName(self, domains, question, pre=[], default=None,
wizard_hint=False, image=None, back=None):
return self.DefaultOrFail(question, default)
def AskMultipleChoice(self, choices, question, pre=[], default=None,
wizard_hint=False, image=None, back=None):
return self.DefaultOrFail(question, default)
def AskBackends(self, kitename, protos, ports, rawports, question, pre=[],
default=None, wizard_hint=False, image=None, back=None):
return self.DefaultOrFail(question, default)
def Working(self, message): pass
def Tell(self, lines, error=False, back=None):
if error:
LogError(' '.join(lines))
raise ConfigError(' '.join(lines))
else:
Log(['message', ' '.join(lines)])
return True
def Notify(self, message, prefix=' ',
popup=False, color=None, now=None, alignright=''):
if popup: Log([('info', '%s%s%s' % (message,
alignright and ' ' or '',
alignright))])
def NotifyMOTD(self, frontend, message):
pass
def NotifyKiteRejected(self, proto, domain, reason, crit=False):
if reason in self.REJECTED_REASONS:
reason = self.REJECTED_REASONS[reason]
self.Notify('REJECTED: %s:%s (%s)' % (proto, domain, reason),
prefix='!', color=(crit and self.RED or self.YELLOW))
def NotifyServer(self, obj, server_info):
self.server_info = server_info
self.Notify('Connecting to front-end %s ...' % server_info[obj.S_NAME],
color=self.GREY)
self.Notify(' - Protocols: %s' % ' '.join(server_info[obj.S_PROTOS]),
color=self.GREY)
self.Notify(' - Ports: %s' % ' '.join(server_info[obj.S_PORTS]),
color=self.GREY)
if 'raw' in server_info[obj.S_PROTOS]:
self.Notify(' - Raw ports: %s' % ' '.join(server_info[obj.S_RAW_PORTS]),
color=self.GREY)
def NotifyQuota(self, quota):
qMB = 1024
self.Notify('You have %.2f MB of quota left.' % (quota / qMB),
prefix=(int(quota) < qMB) and '!' or ' ',
color=self.MAGENTA)
def NotifyFlyingFE(self, proto, port, domain, be=None):
self.Notify(('Flying: %s://%s%s/'
) % (proto, domain, port and ':'+port or ''),
prefix='~<>', color=self.CYAN)
def StartListingBackEnds(self): pass
def EndListingBackEnds(self): pass
def NotifyBE(self, bid, be, has_ssl, dpaths, is_builtin=False):
domain, port, proto = be[BE_DOMAIN], be[BE_PORT], be[BE_PROTO]
prox = (proto == 'raw') and ' (HTTP proxied)' or ''
if proto == 'raw' and port in ('22', 22): proto = 'ssh'
url = '%s://%s%s' % (proto, domain, port and (':%s' % port) or '')
if be[BE_STATUS] == BE_STATUS_UNKNOWN: return
if be[BE_STATUS] & BE_STATUS_OK:
if be[BE_STATUS] & BE_STATUS_ERR_ANY:
status = 'Trying'
color = self.YELLOW
prefix = ' '
else:
status = 'Flying'
color = self.CYAN
prefix = '~<>'
else:
return
self.Notify(('%s %s:%s as %s/%s'
) % (status, be[BE_BHOST], be[BE_BPORT], url, prox),
prefix=prefix, color=color)
if status == 'Flying':
for dp in sorted(dpaths.keys()):
self.Notify(' - %s%s' % (url, dp), color=self.BLUE)
def Status(self, tag, message=None, color=None): pass
def ExplainError(self, error, title, subject=None):
if error == 'pleaselogin':
self.Tell([title, '', 'You already have an account. Log in to continue.'
], error=True)
elif error == 'email':
self.Tell([title, '', 'Invalid e-mail address. Please try again?'
], error=True)
elif error == 'honey':
self.Tell([title, '', 'Hmm. Somehow, you triggered the spam-filter.'
], error=True)
elif error in ('domaintaken', 'domain', 'subdomain'):
self.Tell([title, '',
'Sorry, that domain (%s) is unavailable.' % subject
], error=True)
elif error == 'checkfailed':
self.Tell([title, '',
'That domain (%s) is not correctly set up.' % subject
], error=True)
elif error == 'network':
self.Tell([title, '',
'There was a problem communicating with %s.' % subject, '',
'Please verify that you have a working'
' Internet connection and try again!'
], error=True)
else:
self.Tell([title, 'Error code: %s' % error, 'Try again later?'
], error=True)
class PageKite(object):
\"\"\"Configuration and master select loop.\"\"\"
def __init__(self, ui=None, http_handler=None, http_server=None):
self.progname = ((sys.argv[0] or 'pagekite.py').split('/')[-1]
.split('\\\\')[-1])
self.ui = ui or NullUi()
self.ui_request_handler = http_handler
self.ui_http_server = http_server
self.ResetConfiguration()
def ResetConfiguration(self):
self.isfrontend = False
self.upgrade_info = []
self.auth_domain = None
self.motd = None
self.motd_message = None
self.server_host = ''
self.server_ports = [80]
self.server_raw_ports = []
self.server_portalias = {}
self.server_aliasport = {}
self.server_protos = ['http', 'http2', 'http3', 'https', 'websocket',
'irc', 'finger', 'httpfinger', 'raw']
self.tls_default = None
self.tls_endpoints = {}
self.fe_certname = []
self.fe_anon_tls_wrap = False
self.service_provider = SERVICE_PROVIDER
self.service_xmlrpc = SERVICE_XMLRPC
self.daemonize = False
self.pidfile = None
self.logfile = None
self.setuid = None
self.setgid = None
self.ui_httpd = None
self.ui_sspec_cfg = None
self.ui_sspec = None
self.ui_socket = None
self.ui_password = None
self.ui_pemfile = None
self.ui_magic_file = '.pagekite.magic'
self.ui_paths = {}
self.be_config = {}
self.disable_zchunks = False
self.enable_sslzlib = False
self.buffer_max = DEFAULT_BUFFER_MAX
self.error_url = None
self.finger_path = '/~%s/.finger'
self.tunnel_manager = None
self.client_mode = 0
self.proxy_server = None
self.require_all = False
self.no_probes = False
self.servers = []
self.servers_manual = []
self.servers_auto = None
self.servers_new_only = False
self.servers_no_ping = False
self.servers_preferred = []
self.servers_sessionids = {}
self.kitename = ''
self.kitesecret = ''
self.dyndns = None
self.last_updates = []
self.backends = {} # These are the backends we want tunnels for.
self.conns = None
self.last_loop = 0
self.keep_looping = True
self.main_loop = True
self.crash_report_url = '%scgi-bin/crashes.pl' % WWWHOME
self.rcfile_recursion = 0
self.rcfiles_loaded = []
self.savefile = None
self.autosave = 0
self.reloadfile = None
self.added_kites = False
self.ui_wfile = sys.stderr
self.ui_rfile = sys.stdin
self.ui_port = None
self.ui_conn = None
self.ui_comm = None
self.save = 0
self.kite_add = False
self.kite_only = False
self.kite_disable = False
self.kite_remove = False
# Searching for our configuration file! We prefer the documented
# 'standard' locations, but if nothing is found there and something local
# exists, use that instead.
try:
if sys.platform in ('win32', 'os2', 'os2emx'):
self.rcfile = os.path.join(os.path.expanduser('~'), 'pagekite.cfg')
self.devnull = 'nul'
else:
# Everything else
self.rcfile = os.path.join(os.path.expanduser('~'), '.pagekite.rc')
self.devnull = '/dev/null'
except Exception, e:
# The above stuff may fail in some cases, e.g. on Android in SL4A.
self.rcfile = 'pagekite.cfg'
self.devnull = '/dev/null'
# Look for CA Certificates. If we don't find them in the host OS,
# we assume there might be something good in the program itself.
self.ca_certs_default = '/etc/ssl/certs/ca-certificates.crt'
if not os.path.exists(self.ca_certs_default):
self.ca_certs_default = sys.argv[0]
self.ca_certs = self.ca_certs_default
def SetLocalSettings(self, ports):
self.isfrontend = True
self.servers_auto = None
self.servers_manual = []
self.server_ports = ports
self.backends = self.ArgToBackendSpecs('http:localhost:localhost:builtin:-')
def SetServiceDefaults(self, clobber=True, check=False):
def_dyndns = (DYNDNS['pagekite.net'], {'user': '', 'pass': ''})
def_frontends = (1, 'frontends.b5p.us', 443)
def_ca_certs = sys.argv[0]
def_fe_certs = ['b5p.us', 'frontends.b5p.us', 'pagekite.net']
def_error_url = 'https://pagekite.net/offline/?'
if check:
return (self.dyndns == def_dyndns and
self.servers_auto == def_frontends and
self.error_url == def_error_url and
self.ca_certs == def_ca_certs and
(self.fe_certname == def_fe_certs or not socks.HAVE_SSL))
else:
self.dyndns = (not clobber and self.dyndns) or def_dyndns
self.servers_auto = (not clobber and self.servers_auto) or def_frontends
self.error_url = (not clobber and self.error_url) or def_error_url
self.ca_certs = def_ca_certs
if socks.HAVE_SSL:
for cert in def_fe_certs:
if cert not in self.fe_certname:
self.fe_certname.append(cert)
self.fe_certname.sort()
return True
def GenerateConfig(self, safe=False):
config = [
'###[ Current settings for pagekite.py v%s. ]#########' % APPVER,
'#',
'## NOTE: This file may be rewritten/reordered by pagekite.py.',
'#',
'',
]
if not self.kitename:
for be in self.backends.values():
if not self.kitename or len(self.kitename) < len(be[BE_DOMAIN]):
self.kitename = be[BE_DOMAIN]
self.kitesecret = be[BE_SECRET]
new = not (self.kitename or self.kitesecret or self.backends)
def p(vfmt, value, dval):
return '%s%s' % (value and value != dval
and ('', vfmt % value) or ('# ', vfmt % dval))
if self.kitename or self.kitesecret or new:
config.extend([
'##[ Default kite and account details ]##',
p('kitename=%s', self.kitename, 'NAME'),
p('kitesecret=%s', self.kitesecret, 'SECRET'),
''
])
if self.SetServiceDefaults(check=True):
config.extend([
'##[ Front-end settings: use service defaults ]##',
'defaults',
''
])
if self.servers_manual:
config.append('##[ Manual front-ends ]##')
for server in sorted(self.servers_manual):
config.append('frontend=%s' % server)
config.append('')
else:
if not self.servers_auto and not self.servers_manual:
new = True
config.extend([
'##[ Use this to just use service defaults ]##',
'# defaults',
''
])
config.append('##[ Custom front-end and dynamic DNS settings ]##')
if self.servers_auto:
config.append('frontends=%d:%s:%d' % self.servers_auto)
if self.servers_manual:
for server in sorted(self.servers_manual):
config.append('frontend=%s' % server)
if not self.servers_auto and not self.servers_manual:
new = True
config.append('# frontends=N:hostname:port')
config.append('# frontend=hostname:port')
for server in sorted(self.fe_certname):
config.append('fe_certname=%s' % server)
if self.ca_certs != self.ca_certs_default:
config.append('ca_certs=%s' % self.ca_certs)
if self.dyndns:
provider, args = self.dyndns
for prov in sorted(DYNDNS.keys()):
if DYNDNS[prov] == provider and prov != 'beanstalks.net':
args['prov'] = prov
if 'prov' not in args:
args['prov'] = provider
if args['pass']:
config.append('dyndns=%(user)s:%(pass)s@%(prov)s' % args)
elif args['user']:
config.append('dyndns=%(user)s@%(prov)s' % args)
else:
config.append('dyndns=%(prov)s' % args)
else:
new = True
config.extend([
'# dyndns=pagekite.net OR',
'# dyndns=user:pass@dyndns.org OR',
'# dyndns=user:pass@no-ip.com' ,
'#',
p('errorurl=%s', self.error_url, 'http://host/page/'),
p('fingerpath=%s', self.finger_path, '/~%s/.finger'),
'',
])
if self.ui_sspec or self.ui_password or self.ui_pemfile:
config.extend([
'##[ Built-in HTTPD settings ]##',
p('httpd=%s:%s', self.ui_sspec_cfg, ('host', 'port'))
])
if self.ui_password: config.append('httppass=%s' % self.ui_password)
if self.ui_pemfile: config.append('pemfile=%s' % self.pemfile)
for http_host in sorted(self.ui_paths.keys()):
for path in sorted(self.ui_paths[http_host].keys()):
up = self.ui_paths[http_host][path]
config.append('webpath=%s:%s:%s:%s' % (http_host, path, up[0], up[1]))
config.append('')
config.append('##[ Back-ends and local services ]##')
bprinted = 0
for bid in sorted(self.backends.keys()):
be = self.backends[bid]
proto, domain = bid.split(':')
if be[BE_BHOST]:
be_spec = (be[BE_BHOST], be[BE_BPORT])
config.append(('%s=%s:%s:%s:%s'
) % ((be[BE_STATUS] == BE_STATUS_DISABLED
) and 'define_backend' or 'backend',
proto, ((domain == self.kitename) and '@kitename' or domain),
(be_spec == self.ui_sspec) and 'localhost:builtin' or ('%s:%s' % be_spec),
(be[BE_SECRET] == self.kitesecret) and '@kitesecret' or be[BE_SECRET]))
bprinted += 1
if bprinted == 0:
config.append('# No back-ends! How boring!')
for http_host in sorted(self.be_config.keys()):
for key in sorted(self.be_config[http_host].keys()):
config.append('be_config=%s:%s:%s' % (http_host, key,
self.be_config[http_host][key]))
config.append('')
if bprinted == 0:
new = True
config.extend([
'##[ Back-end examples ... ]##',
'#',
'# backend=http:YOU.pagekite.me:localhost:80:SECRET',
'# backend=ssh:YOU.pagekite.me:localhost:22:SECRET',
'# backend=http/8080:YOU.pagekite.me:localhost:8080:SECRET',
'# backend=https:YOU.pagekite.me:localhost:443:SECRET',
'# backend=websocket:YOU.pagekite.me:localhost:8080:SECRET',
'#',
'# define_backend=http:YOU.pagekite.me:localhost:4545:SECRET',
''
])
if self.isfrontend or new:
config.extend([
'##[ Front-end Options ]##',
(self.isfrontend and 'isfrontend' or '# isfrontend')
])
comment = ((not self.isfrontend) and '# ' or '')
config.extend([
p('host=%s', self.isfrontend and self.server_host, 'machine.domain.com'),
'%sports=%s' % (comment, ','.join(['%s' % x for x in sorted(self.server_ports)] or [])),
'%sprotos=%s' % (comment, ','.join(['%s' % x for x in sorted(self.server_protos)] or []))
])
for pa in self.server_portalias:
config.append('portalias=%s:%s' % (int(pa), int(self.server_portalias[pa])))
config.extend([
'%srawports=%s' % (comment or (not self.server_raw_ports) and '# ' or '',
','.join(['%s' % x for x in sorted(self.server_raw_ports)] or [VIRTUAL_PN])),
p('authdomain=%s', self.isfrontend and self.auth_domain, 'foo.com'),
p('motd=%s', self.isfrontend and self.motd, '/path/to/motd.txt')
])
dprinted = 0
for bid in sorted(self.backends.keys()):
be = self.backends[bid]
if not be[BE_BHOST]:
config.append('domain=%s:%s' % (bid, be[BE_SECRET]))
dprinted += 1
if not dprinted:
new = True
config.extend([
'# domain=http:*.pagekite.me:SECRET1',
'# domain=http,https,websocket:THEM.pagekite.me:SECRET2',
'',
])
eprinted = 0
config.append('##[ Domains we terminate SSL/TLS for natively, with key/cert-files ]##')
for ep in sorted(self.tls_endpoints.keys()):
config.append('tls_endpoint=%s:%s' % (ep, self.tls_endpoints[ep][0]))
eprinted += 1
if eprinted == 0:
new = True
config.append('# tls_endpoint=DOMAIN:PEM_FILE')
config.extend([
p('tls_default=%s', self.tls_default, 'DOMAIN'),
'',
])
config.extend([
'',
'###[ Anything below this line can usually be ignored. ]#########',
'',
'##[ Miscellaneous settings ]##',
p('logfile=%s', self.logfile, '/path/to/file'),
p('buffers=%s', self.buffer_max, DEFAULT_BUFFER_MAX),
(self.servers_new_only is True) and 'new' or '# new',
(self.require_all and 'all' or '# all'),
(self.no_probes and 'noprobes' or '# noprobes'),
(self.crash_report_url and '# nocrashreport' or 'nocrashreport'),
p('savefile=%s', safe and self.savefile, '/path/to/savefile'),
(self.autosave and 'autosave' or '# autosave'),
'',
])
if self.daemonize or self.setuid or self.setgid or self.pidfile or new:
config.extend([
'##[ Systems administration settings ]##',
(self.daemonize and 'daemonize' or '# daemonize')
])
if self.setuid and self.setgid:
config.append('runas=%s:%s' % (self.setuid, self.setgid))
elif self.setuid:
config.append('runas=%s' % self.setuid)
else:
new = True
config.append('# runas=uid:gid')
config.append(p('pidfile=%s', self.pidfile, '/path/to/file'))
config.extend([
'',
'###[ End of pagekite.py configuration ]#########',
'END',
''
])
if not new:
config = [l for l in config if not l.startswith('# ')]
clean_config = []
for i in range(0, len(config)-1):
if i > 0 and (config[i].startswith('#') or config[i] == ''):
if config[i+1] != '' or clean_config[-1].startswith('#'):
clean_config.append(config[i])
else:
clean_config.append(config[i])
clean_config.append(config[-1])
return clean_config
else:
return config
def ConfigSecret(self, new=False):
# This method returns a stable secret for the lifetime of this process.
#
# The secret depends on the active configuration as, reported by
# GenerateConfig(). This lets external processes generate the same
# secret and use the remote-control APIs as long as they can read the
# *entire* config (which contains all the sensitive bits anyway).
#
if self.ui_httpd and self.ui_httpd.httpd and not new:
return self.ui_httpd.httpd.secret
else:
return sha1hex('\\n'.join(self.GenerateConfig()))
def LoginPath(self, goto):
return '/_pagekite/login/%s/%s' % (self.ConfigSecret(), goto)
def LoginUrl(self, goto=''):
return 'http%s://%s%s' % (self.ui_pemfile and 's' or '',
'%s:%s' % self.ui_sspec,
self.LoginPath(goto))
def ListKites(self):
self.ui.welcome = '>>> ' + self.ui.WHITE + 'Your kites:' + self.ui.NORM
message = []
for bid in sorted(self.backends.keys()):
be = self.backends[bid]
be_be = (be[BE_BHOST], be[BE_BPORT])
backend = (be_be == self.ui_sspec) and 'builtin' or '%s:%s' % be_be
fe_port = be[BE_PORT] or ''
frontend = '%s://%s%s%s' % (be[BE_PROTO], be[BE_DOMAIN],
fe_port and ':' or '', fe_port)
if be[BE_STATUS] == BE_STATUS_DISABLED:
color = self.ui.GREY
status = '(disabled)'
else:
color = self.ui.NORM
status = (be[BE_PROTO] == 'raw') and '(HTTP proxied)' or ''
message.append(''.join([color, backend, ' ' * (19-len(backend)),
frontend, ' ' * (42-len(frontend)), status]))
message.append(self.ui.NORM)
self.ui.Tell(message)
def PrintSettings(self, safe=False):
print '\\n'.join(self.GenerateConfig(safe=safe))
def SaveUserConfig(self, quiet=False):
self.savefile = self.savefile or self.rcfile
try:
fd = open(self.savefile, 'w')
fd.write('\\n'.join(self.GenerateConfig(safe=True)))
fd.close()
if not quiet:
self.ui.Tell(['Settings saved to: %s' % self.savefile])
self.ui.Spacer()
Log([('saved', 'Settings saved to: %s' % self.savefile)])
except Exception, e:
self.ui.Tell(['Could not save to %s: %s' % (self.savefile, e)],
error=True)
self.ui.Spacer()
def FallDown(self, message, help=True, longhelp=False, noexit=False):
if self.conns and self.conns.auth: self.conns.auth.quit()
if self.ui_httpd: self.ui_httpd.quit()
if self.ui_comm: self.ui_comm.quit()
if self.tunnel_manager: self.tunnel_manager.quit()
self.keep_looping = False
self.conns = self.ui_httpd = self.ui_comm = self.tunnel_manager = None
if help or longhelp:
print longhelp and DOC or MINIDOC
print '***'
else:
self.ui.Status('exiting', message=(message or 'Good-bye!'))
if message: print 'Error: %s' % message
if DEBUG_IO: traceback.print_exc(file=sys.stderr)
if not noexit:
self.main_loop = False
sys.exit(1)
def GetTlsEndpointCtx(self, domain):
if domain in self.tls_endpoints: return self.tls_endpoints[domain][1]
parts = domain.split('.')
# Check for wildcards ...
while len(parts) > 2:
parts[0] = '*'
domain = '.'.join(parts)
if domain in self.tls_endpoints: return self.tls_endpoints[domain][1]
parts.pop(0)
return None
def SetBackendStatus(self, domain, proto='', add=None, sub=None):
match = '%s:%s' % (proto, domain)
for bid in self.backends:
if bid == match or (proto == '' and bid.endswith(match)):
status = self.backends[bid][BE_STATUS]
if add: self.backends[bid][BE_STATUS] |= add
if sub and (status & sub): self.backends[bid][BE_STATUS] -= sub
Log([('bid', bid),
('status', '0x%x' % self.backends[bid][BE_STATUS])])
def GetBackendData(self, proto, domain, recurse=True):
backend = '%s:%s' % (proto.lower(), domain.lower())
if backend in self.backends:
if self.backends[backend][BE_STATUS] not in BE_INACTIVE:
return self.backends[backend]
if recurse:
dparts = domain.split('.')
while len(dparts) > 1:
dparts = dparts[1:]
data = self.GetBackendData(proto, '.'.join(['*'] + dparts), recurse=False)
if data: return data
return None
def GetBackendServer(self, proto, domain, recurse=True):
backend = self.GetBackendData(proto, domain) or BE_NONE
bhost, bport = (backend[BE_BHOST], backend[BE_BPORT])
if bhost == '-' or not bhost: return None, None
return (bhost, bport), backend
def IsSignatureValid(self, sign, secret, proto, domain, srand, token):
return checkSignature(sign=sign, secret=secret,
payload='%s:%s:%s:%s' % (proto, domain, srand, token))
def LookupDomainQuota(self, lookup):
if not lookup.endswith('.'): lookup += '.'
if DEBUG_IO: print '=== AUTH LOOKUP\\n%s\\n===' % lookup
(hn, al, ips) = socket.gethostbyname_ex(lookup)
if DEBUG_IO: print 'hn=%s\\nal=%s\\nips=%s\\n' % (hn, al, ips)
# Extract auth error hints from domain name, if we got a CNAME reply.
if al:
error = hn.split('.')[0]
else:
error = None
# If not an authentication error, quota should be encoded as an IP.
ip = ips[0]
if not ip.startswith(AUTH_ERRORS):
o = [int(x) for x in ip.split('.')]
return ((((o[0]*256 + o[1])*256 + o[2])*256 + o[3]), None)
# Errors on real errors are final.
if not ip.endswith(AUTH_ERR_USER_UNKNOWN): return (None, error)
# User unknown, fall through to local test.
return (-1, error)
def GetDomainQuota(self, protoport, domain, srand, token, sign,
recurse=True, check_token=True):
if '-' in protoport:
try:
proto, port = protoport.split('-', 1)
if proto == 'raw':
port_list = self.server_raw_ports
else:
port_list = self.server_ports
porti = int(port)
if porti in self.server_aliasport: porti = self.server_aliasport[porti]
if porti not in port_list and VIRTUAL_PN not in port_list:
LogInfo('Unsupported port request: %s (%s:%s)' % (porti, protoport, domain))
return (None, 'port')
except ValueError:
LogError('Invalid port request: %s:%s' % (protoport, domain))
return (None, 'port')
else:
proto, port = protoport, None
if proto not in self.server_protos:
LogInfo('Invalid proto request: %s:%s' % (protoport, domain))
return (None, 'proto')
data = '%s:%s:%s' % (protoport, domain, srand)
auth_error_type = None
if ((not token) or
(not check_token) or
checkSignature(sign=token, payload=data)):
secret = (self.GetBackendData(protoport, domain) or BE_NONE)[BE_SECRET]
if not secret:
secret = (self.GetBackendData(proto, domain) or BE_NONE)[BE_SECRET]
if secret:
if self.IsSignatureValid(sign, secret, protoport, domain, srand, token):
return (-1, None)
elif not self.auth_domain:
LogError('Invalid signature for: %s (%s)' % (domain, protoport))
return (None, auth_error_type or 'signature')
if self.auth_domain:
try:
lookup = '.'.join([srand, token, sign, protoport, domain, self.auth_domain])
(rv, auth_error_type) = self.LookupDomainQuota(lookup)
if rv is None or rv >= 0:
return (rv, auth_error_type)
except Exception, e:
# Lookup failed, fail open.
LogError('Quota lookup failed: %s' % e)
return (-2, None)
LogInfo('No authentication found for: %s (%s)' % (domain, protoport))
return (None, auth_error_type or 'unauthorized')
def ConfigureFromFile(self, filename=None, data=None):
if not filename: filename = self.rcfile
if self.rcfile_recursion > 25:
raise ConfigError('Nested too deep: %s' % filename)
self.rcfiles_loaded.append(filename)
optfile = data or open(filename)
args = []
for line in optfile:
line = line.strip()
if line and not line.startswith('#'):
if line.startswith('END'): break
if not line.startswith('-'): line = '--%s' % line
args.append(line)
self.rcfile_recursion += 1
self.Configure(args)
self.rcfile_recursion -= 1
return self
def ConfigureFromDirectory(self, dirname):
for fn in sorted(os.listdir(dirname)):
if not fn.startswith('.') and fn.endswith('.rc'):
self.ConfigureFromFile(os.path.join(dirname, fn))
def HelpAndExit(self, longhelp=False):
print longhelp and DOC or MINIDOC
sys.exit(0)
def ArgToBackendSpecs(self, arg, status=BE_STATUS_UNKNOWN, secret=None):
protos, fe_domain, be_host, be_port = '', '', '', ''
# Interpret the argument into a specification of what we want.
parts = arg.split(':')
if len(parts) == 5:
protos, fe_domain, be_host, be_port, secret = parts
elif len(parts) == 4:
protos, fe_domain, be_host, be_port = parts
elif len(parts) == 3:
protos, fe_domain, be_port = parts
elif len(parts) == 2:
if (parts[1] == 'builtin') or ('.' in parts[0] and
os.path.exists(parts[1])):
fe_domain, be_port = parts[0], parts[1]
protos = 'http'
else:
try:
fe_domain, be_port = parts[0], '%s' % int(parts[1])
protos = 'http'
except:
be_port = ''
protos, fe_domain = parts
elif len(parts) == 1:
fe_domain = parts[0]
else:
return {}
# Allow http:// as a common typo instead of http:
fe_domain = fe_domain.replace('/', '').lower()
# Allow easy referencing of built-in HTTPD
if be_port == 'builtin':
self.BindUiSspec()
be_host, be_port = self.ui_sspec
# Specs define what we are searching for...
specs = []
if protos:
for proto in protos.replace('/', '-').lower().split(','):
if proto == 'ssh':
specs.append(['raw', '22', fe_domain, be_host, be_port or '22', secret])
else:
if '-' in proto:
proto, port = proto.split('-')
else:
if len(parts) == 1:
port = '*'
else:
port = ''
specs.append([proto, port, fe_domain, be_host, be_port, secret])
else:
specs = [[None, '', fe_domain, be_host, be_port, secret]]
backends = {}
# For each spec, search through the existing backends and copy matches
# or just shared secrets for partial matches.
for proto, port, fdom, bhost, bport, sec in specs:
matches = 0
for bid in self.backends:
be = self.backends[bid]
if fdom and fdom != be[BE_DOMAIN]: continue
if not sec and be[BE_SECRET]: sec = be[BE_SECRET]
if proto and (proto != be[BE_PROTO]): continue
if bhost and (bhost.lower() != be[BE_BHOST]): continue
if bport and (int(bport) != be[BE_BHOST]): continue
if port and (port != '*') and (int(port) != be[BE_PORT]): continue
backends[bid] = be[:]
backends[bid][BE_STATUS] = status
matches += 1
if matches == 0:
proto = (proto or 'http')
bhost = (bhost or 'localhost')
bport = (bport or (proto in ('http', 'httpfinger', 'websocket') and 80)
or (proto == 'irc' and 6667)
or (proto == 'https' and 443)
or (proto == 'finger' and 79))
if port:
bid = '%s-%d:%s' % (proto, int(port), fdom)
else:
bid = '%s:%s' % (proto, fdom)
backends[bid] = BE_NONE[:]
backends[bid][BE_PROTO] = proto
backends[bid][BE_PORT] = port and int(port) or ''
backends[bid][BE_DOMAIN] = fdom
backends[bid][BE_BHOST] = bhost.lower()
backends[bid][BE_BPORT] = int(bport)
backends[bid][BE_SECRET] = sec
backends[bid][BE_STATUS] = status
return backends
def BindUiSspec(self, force=False):
# Create the UI thread
if self.ui_httpd and self.ui_httpd.httpd:
if not force: return self.ui_sspec
self.ui_httpd.httpd.socket.close()
self.ui_sspec = self.ui_sspec or ('localhost', 0)
self.ui_httpd = HttpUiThread(self, self.conns,
handler=self.ui_request_handler,
server=self.ui_http_server,
ssl_pem_filename = self.ui_pemfile)
return self.ui_sspec
def LoadMOTD(self):
if self.motd:
try:
f = open(self.motd, 'r')
self.motd_message = ''.join(f.readlines()).strip()[:8192]
f.close()
except (OSError, IOError):
pass
def Configure(self, argv):
self.conns = self.conns or Connections(self)
opts, args = getopt.getopt(argv, OPT_FLAGS, OPT_ARGS)
for opt, arg in opts:
if opt in ('-o', '--optfile'):
self.ConfigureFromFile(arg)
elif opt in ('-O', '--optdir'):
self.ConfigureFromDirectory(arg)
elif opt == '--reloadfile':
self.ConfigureFromFile(arg)
self.reloadfile = arg
elif opt in ('-S', '--savefile'):
if self.savefile: raise ConfigError('Multiple save-files!')
self.savefile = arg
elif opt == '--autosave':
self.autosave = True
elif opt == '--noautosave':
self.autosave = False
elif opt == '--save':
self.save = True
elif opt == '--only':
self.save = self.kite_only = True
if self.kite_remove or self.kite_add or self.kite_disable:
raise ConfigError('One change at a time please!')
elif opt == '--add':
self.save = self.kite_add = True
if self.kite_remove or self.kite_only or self.kite_disable:
raise ConfigError('One change at a time please!')
elif opt == '--remove':
self.save = self.kite_remove = True
if self.kite_add or self.kite_only or self.kite_disable:
raise ConfigError('One change at a time please!')
elif opt == '--disable':
self.save = self.kite_disable = True
if self.kite_add or self.kite_only or self.kite_remove:
raise ConfigError('One change at a time please!')
elif opt == '--list': pass
elif opt in ('-I', '--pidfile'): self.pidfile = arg
elif opt in ('-L', '--logfile'): self.logfile = arg
elif opt in ('-Z', '--daemonize'):
self.daemonize = True
if not self.ui.DAEMON_FRIENDLY: self.ui = NullUi()
elif opt in ('-U', '--runas'):
import pwd
import grp
parts = arg.split(':')
if len(parts) > 1:
self.setuid, self.setgid = (pwd.getpwnam(parts[0])[2],
grp.getgrnam(parts[1])[2])
else:
self.setuid = pwd.getpwnam(parts[0])[2]
self.main_loop = False
elif opt in ('-X', '--httppass'): self.ui_password = arg
elif opt in ('-P', '--pemfile'): self.ui_pemfile = arg
elif opt in ('-H', '--httpd'):
parts = arg.split(':')
host = parts[0] or 'localhost'
if len(parts) > 1:
self.ui_sspec = self.ui_sspec_cfg = (host, int(parts[1]))
else:
self.ui_sspec = self.ui_sspec_cfg = (host, 0)
elif opt == '--nowebpath':
host, path = arg.split(':', 1)
if host in self.ui_paths and path in self.ui_paths[host]:
del self.ui_paths[host][path]
elif opt == '--webpath':
host, path, policy, fpath = arg.split(':', 3)
# Defaults...
path = path or os.path.normpath(fpath)
host = host or '*'
policy = policy or WEB_POLICY_DEFAULT
if policy not in WEB_POLICIES:
raise ConfigError('Policy must be one of: %s' % WEB_POLICIES)
elif os.path.isdir(fpath):
if not path.endswith('/'): path += '/'
hosti = self.ui_paths.get(host, {})
hosti[path] = (policy or 'public', os.path.abspath(fpath))
self.ui_paths[host] = hosti
elif opt == '--tls_default': self.tls_default = arg
elif opt == '--tls_endpoint':
name, pemfile = arg.split(':', 1)
ctx = SSL.Context(SSL.SSLv23_METHOD)
ctx.use_privatekey_file(pemfile)
ctx.use_certificate_chain_file(pemfile)
self.tls_endpoints[name] = (pemfile, ctx)
elif opt in ('-D', '--dyndns'):
if arg.startswith('http'):
self.dyndns = (arg, {'user': '', 'pass': ''})
elif '@' in arg:
splits = arg.split('@')
provider = splits.pop()
usrpwd = '@'.join(splits)
if provider in DYNDNS: provider = DYNDNS[provider]
if ':' in usrpwd:
usr, pwd = usrpwd.split(':', 1)
self.dyndns = (provider, {'user': usr, 'pass': pwd})
else:
self.dyndns = (provider, {'user': usrpwd, 'pass': ''})
elif arg:
if arg in DYNDNS: arg = DYNDNS[arg]
self.dyndns = (arg, {'user': '', 'pass': ''})
else:
self.dyndns = None
elif opt in ('-p', '--ports'): self.server_ports = [int(x) for x in arg.split(',')]
elif opt == '--portalias':
port, alias = arg.split(':')
self.server_portalias[int(port)] = int(alias)
self.server_aliasport[int(alias)] = int(port)
elif opt == '--protos': self.server_protos = [x.lower() for x in arg.split(',')]
elif opt == '--rawports':
self.server_raw_ports = [(x == VIRTUAL_PN and x or int(x)) for x in arg.split(',')]
elif opt in ('-h', '--host'): self.server_host = arg
elif opt in ('-A', '--authdomain'): self.auth_domain = arg
elif opt == '--motd':
self.motd = arg
self.LoadMOTD()
elif opt == '--noupgradeinfo': self.upgrade_info = []
elif opt == '--upgradeinfo':
version, tag, md5, human_url, file_url = arg.split(';')
self.upgrade_info.append((version, tag, md5, human_url, file_url))
elif opt in ('-f', '--isfrontend'):
self.isfrontend = True
global LOG_THRESHOLD
LOG_THRESHOLD *= 4
elif opt in ('-a', '--all'): self.require_all = True
elif opt in ('-N', '--new'): self.servers_new_only = True
elif opt in ('--proxy', '--socksify', '--torify'):
if opt == '--proxy':
socks.setdefaultproxy()
for proxy in arg.split(','):
socks.adddefaultproxy(*socks.parseproxy(proxy))
else:
(host, port) = arg.split(':')
socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5, host, int(port))
if not self.proxy_server:
# Make DynDNS updates go via the proxy.
socks.wrapmodule(urllib)
self.proxy_server = arg
else:
self.proxy_server += ',' + arg
if opt == '--torify':
self.servers_new_only = True # Disable initial DNS lookups (leaks)
self.servers_no_ping = True # Disable front-end pings
self.crash_report_url = None # Disable crash reports
# This increases the odds of unrelated requests getting lumped
# together in the tunnel, which makes traffic analysis harder.
global SEND_ALWAYS_BUFFERS
SEND_ALWAYS_BUFFERS = True
elif opt == '--ca_certs': self.ca_certs = arg
elif opt == '--jakenoia': self.fe_anon_tls_wrap = True
elif opt == '--fe_certname':
if arg == '':
self.fe_certname = []
else:
cert = arg.lower()
if cert not in self.fe_certname: self.fe_certname.append(cert)
self.fe_certname.sort()
elif opt == '--service_xmlrpc': self.service_xmlrpc = arg
elif opt == '--frontend': self.servers_manual.append(arg)
elif opt == '--frontends':
count, domain, port = arg.split(':')
self.servers_auto = (int(count), domain, int(port))
elif opt in ('--errorurl', '-E'): self.error_url = arg
elif opt == '--fingerpath': self.finger_path = arg
elif opt == '--kitename': self.kitename = arg
elif opt == '--kitesecret': self.kitesecret = arg
elif opt in ('--backend', '--define_backend'):
bes = self.ArgToBackendSpecs(arg.replace('@kitesecret', self.kitesecret)
.replace('@kitename', self.kitename),
status=((opt != '--backend')
and BE_STATUS_DISABLED
or BE_STATUS_UNKNOWN))
for bid in bes:
if bid in self.backends:
raise ConfigError(\"Same backend/domain defined twice: %s\" % bid)
if not self.kitename:
self.kitename = bes[bid][BE_DOMAIN]
self.kitesecret = bes[bid][BE_SECRET]
self.backends.update(bes)
elif opt == '--be_config':
host, key, val = arg.split(':', 2)
if key.startswith('user/'): key = key.replace('user/', 'password/')
hostc = self.be_config.get(host, {})
hostc[key] = {'True': True, 'False': False, 'None': None}.get(val, val)
self.be_config[host] = hostc
elif opt == '--delete_backend':
bes = self.ArgToBackendSpecs(arg)
for bid in bes:
if bid in self.backends:
del self.backends[bid]
elif opt == '--domain':
protos, domain, secret = arg.split(':')
if protos in ('*', ''): protos = ','.join(self.server_protos)
for proto in protos.split(','):
bid = '%s:%s' % (proto, domain)
if bid in self.backends:
raise ConfigError(\"Same backend/domain defined twice: %s\" % bid)
self.backends[bid] = BE_NONE[:]
self.backends[bid][BE_PROTO] = proto
self.backends[bid][BE_DOMAIN] = domain
self.backends[bid][BE_SECRET] = secret
self.backends[bid][BE_STATUS] = BE_STATUS_UNKNOWN
elif opt == '--noprobes': self.no_probes = True
elif opt == '--nofrontend': self.isfrontend = False
elif opt == '--nodaemonize': self.daemonize = False
elif opt == '--noall': self.require_all = False
elif opt == '--nozchunks': self.disable_zchunks = True
elif opt == '--nullui': self.ui = NullUi()
elif opt == '--remoteui':
import pagekite.remoteui
self.ui = pagekite.remoteui.RemoteUi()
elif opt == '--uiport': self.ui_port = int(arg)
elif opt == '--sslzlib': self.enable_sslzlib = True
elif opt == '--debugio':
global DEBUG_IO
DEBUG_IO = True
elif opt == '--buffers': self.buffer_max = int(arg)
elif opt == '--nocrashreport': self.crash_report_url = None
elif opt == '--noloop': self.main_loop = False
elif opt == '--local':
self.SetLocalSettings([int(p) for p in arg.split(',')])
if not 'localhost' in args: args.append('localhost')
elif opt == '--defaults': self.SetServiceDefaults()
elif opt in ('--clean', '--nopyopenssl', '--nossl', '--settings',
'--webaccess', '--webindexes',
'--webroot', '--signup', '--friendly'): pass
elif opt == '--help':
self.HelpAndExit(longhelp=True)
elif opt == '--controlpanel':
import webbrowser
webbrowser.open(self.LoginUrl())
sys.exit(0)
elif opt == '--controlpass':
print self.ConfigSecret()
sys.exit(0)
else:
self.HelpAndExit()
# Make sure these are configured before we try and do XML-RPC stuff.
socks.DEBUG = (DEBUG_IO or socks.DEBUG) and LogDebug
if self.ca_certs: socks.setdefaultcertfile(self.ca_certs)
# Handle the user-friendly argument stuff and simple registration.
return self.ParseFriendlyBackendSpecs(args)
def ParseFriendlyBackendSpecs(self, args):
just_these_backends = {}
just_these_webpaths = {}
just_these_be_configs = {}
argsets = []
while 'AND' in args:
argsets.append(args[0:args.index('AND')])
args[0:args.index('AND')+1] = []
if args:
argsets.append(args)
for args in argsets:
# Extract the config options first...
be_config = [p for p in args if p.startswith('+')]
args = [p for p in args if not p.startswith('+')]
fe_spec = (args.pop().replace('@kitesecret', self.kitesecret)
.replace('@kitename', self.kitename))
if os.path.exists(fe_spec):
raise ConfigError('Is a local file: %s' % fe_spec)
be_paths = []
be_path_prefix = ''
if len(args) == 0:
be_spec = ''
elif len(args) == 1:
if '*' in args[0] or '?' in args[0]:
if sys.platform in ('win32', 'os2', 'os2emx'):
be_paths = [args[0]]
be_spec = 'builtin'
elif os.path.exists(args[0]):
be_paths = [args[0]]
be_spec = 'builtin'
else:
be_spec = args[0]
else:
be_spec = 'builtin'
be_paths = args[:]
be_proto = 'http' # A sane default...
if be_spec == '':
be = None
else:
be = be_spec.replace('/', '').split(':')
if be[0].lower() in ('http', 'http2', 'http3', 'https',
'httpfinger', 'finger', 'ssh', 'irc'):
be_proto = be.pop(0)
if len(be) < 2:
be.append({'http': '80', 'http2': '80', 'http3': '80',
'https': '443', 'irc': '6667',
'httpfinger': '80', 'finger': '79',
'ssh': '22'}[be_proto])
if len(be) > 2:
raise ConfigError('Bad back-end definition: %s' % be_spec)
if len(be) < 2:
be = ['localhost', be[0]]
# Extract the path prefix from the fe_spec
fe_urlp = fe_spec.split('/', 3)
if len(fe_urlp) == 4:
fe_spec = '/'.join(fe_urlp[:3])
be_path_prefix = '/' + fe_urlp[3]
fe = fe_spec.replace('/', '').split(':')
if len(fe) == 3:
fe = ['%s-%s' % (fe[0], fe[2]), fe[1]]
elif len(fe) == 2:
try:
fe = ['%s-%s' % (be_proto, int(fe[1])), fe[0]]
except ValueError:
pass
elif len(fe) == 1 and be:
fe = [be_proto, fe[0]]
# Do our own globbing on Windows
if sys.platform in ('win32', 'os2', 'os2emx'):
import glob
new_paths = []
for p in be_paths:
new_paths.extend(glob.glob(p))
be_paths = new_paths
for f in be_paths:
if not os.path.exists(f):
raise ConfigError('File or directory not found: %s' % f)
spec = ':'.join(fe)
if be: spec += ':' + ':'.join(be)
specs = self.ArgToBackendSpecs(spec)
just_these_backends.update(specs)
spec = specs[specs.keys()[0]]
http_host = '%s/%s' % (spec[BE_DOMAIN], spec[BE_PORT] or '80')
if be_config:
# Map the +foo=bar values to per-site config settings.
host_config = just_these_be_configs.get(http_host, {})
for cfg in be_config:
if '=' in cfg:
key, val = cfg[1:].split('=', 1)
elif cfg.startswith('+no'):
key, val = cfg[3:], False
else:
key, val = cfg[1:], True
if ':' in key:
raise ConfigError('Please do not use : in web config keys.')
if key.startswith('user/'): key = key.replace('user/', 'password/')
host_config[key] = val
just_these_be_configs[http_host] = host_config
if be_paths:
host_paths = just_these_webpaths.get(http_host, {})
host_config = just_these_be_configs.get(http_host, {})
rand_seed = '%s:%x' % (specs[specs.keys()[0]][BE_SECRET],
time.time()/3600)
first = (len(host_paths.keys()) == 0) or be_path_prefix
paranoid = host_config.get('hide', False)
set_root = host_config.get('root', True)
if len(be_paths) == 1:
skip = 0
else:
skip = len(os.path.dirname(os.path.commonprefix(be_paths)+'X'))
for path in be_paths:
phead, ptail = os.path.split(path)
if paranoid:
if path.endswith('/'): path = path[0:-1]
webpath = '%s/%s' % (sha1hex(rand_seed+os.path.dirname(path))[0:9],
os.path.basename(path))
elif (first and set_root and os.path.isdir(path)):
webpath = ''
elif (os.path.isdir(path) and
not path.startswith('.') and
not os.path.isabs(path)):
webpath = path[skip:] + '/'
elif path == '.':
webpath = ''
else:
webpath = path[skip:]
while webpath.endswith('/.'):
webpath = webpath[:-2]
host_paths[(be_path_prefix + '/' + webpath).replace('///', '/'
).replace('//', '/')
] = (WEB_POLICY_DEFAULT, os.path.abspath(path))
first = False
just_these_webpaths[http_host] = host_paths
need_registration = {}
for be in just_these_backends.values():
if not be[BE_SECRET]:
if self.kitesecret and be[BE_DOMAIN] == self.kitename:
be[BE_SECRET] = self.kitesecret
else:
need_registration[be[BE_DOMAIN]] = True
for domain in need_registration:
result = self.RegisterNewKite(kitename=domain)
if not result:
raise ConfigError(\"Not sure what to do with %s, giving up.\" % domain)
# Update the secrets...
rdom, rsecret = result
for be in just_these_backends.values():
if be[BE_DOMAIN] == domain: be[BE_SECRET] = rsecret
# Update the kite names themselves, if they changed.
if rdom != domain:
for bid in just_these_backends.keys():
nbid = bid.replace(':'+domain, ':'+rdom)
if nbid != bid:
just_these_backends[nbid] = just_these_backends[bid]
just_these_backends[nbid][BE_DOMAIN] = rdom
del just_these_backends[bid]
if just_these_backends.keys():
if self.kite_add:
self.backends.update(just_these_backends)
elif self.kite_remove:
for bid in just_these_backends:
be = self.backends[bid]
if be[BE_PROTO] in ('http', 'http2', 'http3'):
http_host = '%s/%s' % (be[BE_DOMAIN], be[BE_PORT] or '80')
if http_host in self.ui_paths: del self.ui_paths[http_host]
if http_host in self.be_config: del self.be_config[http_host]
del self.backends[bid]
elif self.kite_disable:
for bid in just_these_backends:
self.backends[bid][BE_STATUS] = BE_STATUS_DISABLED
elif self.kite_only:
for be in self.backends.values(): be[BE_STATUS] = BE_STATUS_DISABLED
self.backends.update(just_these_backends)
else:
# Nothing explictly requested: 'only' behavior with a twist;
# If kites are new, don't make disables persist on save.
for be in self.backends.values():
be[BE_STATUS] = (need_registration and BE_STATUS_DISABLE_ONCE
or BE_STATUS_DISABLED)
self.backends.update(just_these_backends)
self.ui_paths.update(just_these_webpaths)
self.be_config.update(just_these_be_configs)
return self
def GetServiceXmlRpc(self):
service = self.service_xmlrpc
if service == 'mock':
return MockPageKiteXmlRpc(self)
else:
return xmlrpclib.ServerProxy(self.service_xmlrpc, None, None, False)
def _KiteInfo(self, kitename):
is_service_domain = kitename and SERVICE_DOMAIN_RE.search(kitename)
is_subdomain_of = is_cname_for = is_cname_ready = False
secret = None
for be in self.backends.values():
if be[BE_SECRET] and (be[BE_DOMAIN] == kitename):
secret = be[BE_SECRET]
if is_service_domain:
parts = kitename.split('.')
if '-' in parts[0]:
parts[0] = '-'.join(parts[0].split('-')[1:])
is_subdomain_of = '.'.join(parts)
elif len(parts) > 3:
is_subdomain_of = '.'.join(parts[1:])
elif kitename:
try:
(hn, al, ips) = socket.gethostbyname_ex(kitename)
if hn != kitename and SERVICE_DOMAIN_RE.search(hn):
is_cname_for = hn
except:
pass
return (secret, is_subdomain_of, is_service_domain,
is_cname_for, is_cname_ready)
def RegisterNewKite(self, kitename=None, first=False,
ask_be=False, autoconfigure=False):
registered = False
if kitename:
(secret, is_subdomain_of, is_service_domain,
is_cname_for, is_cname_ready) = self._KiteInfo(kitename)
if secret:
self.ui.StartWizard('Updating kite: %s' % kitename)
registered = True
else:
self.ui.StartWizard('Creating kite: %s' % kitename)
else:
if first:
self.ui.StartWizard('Create your first kite')
else:
self.ui.StartWizard('Creating a new kite')
is_subdomain_of = is_service_domain = False
is_cname_for = is_cname_ready = False
# This is the default...
be_specs = ['http:%s:localhost:80']
service = self.GetServiceXmlRpc()
service_accounts = {}
if self.kitename and self.kitesecret:
service_accounts[self.kitename] = self.kitesecret
for be in self.backends.values():
if SERVICE_DOMAIN_RE.search(be[BE_DOMAIN]):
if be[BE_DOMAIN] == is_cname_for:
is_cname_ready = True
if be[BE_SECRET] not in service_accounts.values():
service_accounts[be[BE_DOMAIN]] = be[BE_SECRET]
service_account_list = service_accounts.keys()
if registered:
state = ['choose_backends']
if service_account_list:
state = ['choose_kite_account']
else:
state = ['use_service_question']
history = []
def Goto(goto, back_skips_current=False):
if not back_skips_current: history.append(state[0])
state[0] = goto
def Back():
if history:
state[0] = history.pop(-1)
else:
Goto('abort')
register = is_cname_for or kitename
account = email = None
while 'end' not in state:
try:
if 'use_service_question' in state:
ch = self.ui.AskYesNo('Use the service?',
pre=['Welcome to PageKite!',
'',
'Please answer a few quick questions to',
'create your first kite.',
'',
'By continuing, you agree to play nice',
'and abide by the Terms of Service at:',
'- %s' % (SERVICE_TOS_URL, SERVICE_TOS_URL)],
default=True, back=-1, no='Abort')
if ch is True:
self.SetServiceDefaults(clobber=False)
if not kitename:
Goto('service_signup_email')
elif is_cname_for and is_cname_ready:
register = kitename
Goto('service_signup_email')
elif is_service_domain:
register = is_cname_for or kitename
if is_subdomain_of:
# FIXME: Shut up if parent is already in local config!
Goto('service_signup_is_subdomain')
else:
Goto('service_signup_email')
else:
Goto('service_signup_bad_domain')
else:
Goto('manual_abort')
elif 'service_login_email' in state:
p = None
while not email or not p:
(email, p) = self.ui.AskLogin('Please log on ...', pre=[
'By logging on to %s,' % self.service_provider,
'you will be able to use this kite',
'with your pre-existing account.'
], email=email, back=(email, False))
if email and p:
try:
self.ui.Working('Logging on to your account')
service_accounts[email] = service.getSharedSecret(email, p)
# FIXME: Should get the list of preconfigured kites via. RPC
# so we don't try to create something that already
# exists? Or should the RPC not just not complain?
account = email
Goto('create_kite')
except:
email = p = None
self.ui.Tell(['Login failed! Try again?'], error=True)
if p is False:
Back()
break
elif ('service_signup_is_subdomain' in state):
ch = self.ui.AskYesNo('Use this name?',
pre=['%s is a sub-domain.' % kitename, '',
'NOTE: This process will fail if you',
'have not already registered the parent',
'domain, %s.' % is_subdomain_of],
default=True, back=-1)
if ch is True:
if account:
Goto('create_kite')
elif email:
Goto('service_signup')
else:
Goto('service_signup_email')
elif ch is False:
Goto('service_signup_kitename')
else:
Back()
elif ('service_signup_bad_domain' in state or
'service_login_bad_domain' in state):
if is_cname_for:
alternate = is_cname_for
ch = self.ui.AskYesNo('Create both?',
pre=['%s is a CNAME for %s.' % (kitename, is_cname_for)],
default=True, back=-1)
else:
alternate = kitename.split('.')[-2]+'.'+SERVICE_DOMAINS[0]
ch = self.ui.AskYesNo('Try to create %s instead?' % alternate,
pre=['Sorry, %s is not a valid service domain.' % kitename],
default=True, back=-1)
if ch is True:
register = alternate
Goto(state[0].replace('bad_domain', 'email'))
elif ch is False:
register = alternate = kitename = False
Goto('service_signup_kitename', back_skips_current=True)
else:
Back()
elif 'service_signup_email' in state:
email = self.ui.AskEmail('What is your e-mail address?',
pre=['We need to be able to contact you',
'now and then with news about the',
'service and your account.',
'',
'Your details will be kept private.'],
back=False)
if email and register:
Goto('service_signup')
elif email:
Goto('service_signup_kitename')
else:
Back()
elif ('service_signup_kitename' in state or
'service_ask_kitename' in state):
try:
self.ui.Working('Fetching list of available domains')
domains = service.getAvailableDomains(None, None)
except:
domains = ['.%s' % x for x in SERVICE_DOMAINS]
ch = self.ui.AskKiteName(domains, 'Name this kite:',
pre=['Your kite name becomes the public name',
'of your personal server or web-site.',
'',
'Names are provided on a first-come,',
'first-serve basis. You can create more',
'kites with different names later on.'],
back=False)
if ch:
kitename = register = ch
(secret, is_subdomain_of, is_service_domain,
is_cname_for, is_cname_ready) = self._KiteInfo(ch)
if secret:
self.ui.StartWizard('Updating kite: %s' % kitename)
registered = True
else:
self.ui.StartWizard('Creating kite: %s' % kitename)
Goto('choose_backends')
else:
Back()
elif 'choose_backends' in state:
if ask_be and autoconfigure:
skip = False
ch = self.ui.AskBackends(kitename, ['http'], ['80'], [],
'Enable which service?', back=False, pre=[
'You control which of your files or servers',
'PageKite exposes to the Internet. ',
], default=','.join(be_specs))
if ch:
be_specs = ch.split(',')
else:
skip = ch = True
if ch:
if registered:
Goto('create_kite', back_skips_current=skip)
elif is_subdomain_of:
Goto('service_signup_is_subdomain', back_skips_current=skip)
elif account:
Goto('create_kite', back_skips_current=skip)
elif email:
Goto('service_signup', back_skips_current=skip)
else:
Goto('service_signup_email', back_skips_current=skip)
else:
Back()
elif 'service_signup' in state:
try:
self.ui.Working('Signing up')
details = service.signUp(email, register)
if details.get('secret', False):
service_accounts[email] = details['secret']
self.ui.AskYesNo('Continue?', pre=[
'Your kite is ready to fly!',
'',
'Note: To complete the signup process,',
'check your e-mail (and spam folders) for',
'activation instructions. You can give',
'PageKite a try first, but un-activated',
'accounts are disabled after %d minutes.' % details['timeout'],
], yes='Finish', no=False, default=True)
self.ui.EndWizard()
if autoconfigure:
print 'Backends: %s (register=%s)' % (be_specs, register)
for be_spec in be_specs:
self.backends.update(self.ArgToBackendSpecs(
be_spec % register,
secret=details['secret']))
self.added_kites = True
return (register, details['secret'])
else:
error = details.get('error', 'unknown')
except IOError:
error = 'network'
except:
error = '%s' % (sys.exc_info(), )
if error == 'pleaselogin':
#self.ui.ExplainError(error,
# '%s log-in required.' % self.service_provider,
# subject=register)
Goto('service_login_email', back_skips_current=True)
elif error == 'email':
self.ui.ExplainError(error, 'Signup failed!', subject=register)
Goto('service_login_email', back_skips_current=True)
elif error in ('domain', 'domaintaken', 'subdomain'):
register, kitename = None, None
self.ui.ExplainError(error, 'Invalid domain!', subject=register)
Goto('service_signup_kitename', back_skips_current=True)
elif error == 'network':
self.ui.ExplainError(error, 'Network error!', subject=self.service_provider)
Goto('service_signup', back_skips_current=True)
else:
self.ui.ExplainError(error, 'Unknown problem!')
print 'FIXME! Error is %s' % error
Goto('abort')
elif 'choose_kite_account' in state:
choices = service_account_list[:]
choices.append('Use another service provider')
justdoit = (len(service_account_list) == 1)
if justdoit:
ch = 1
else:
ch = self.ui.AskMultipleChoice(choices, 'Register with',
pre=['Choose an account for this kite:'],
default=1)
account = choices[ch-1]
if ch == len(choices):
Goto('manual_abort')
elif kitename:
Goto('choose_backends', back_skips_current=justdoit)
else:
Goto('service_ask_kitename', back_skips_current=justdoit)
elif 'create_kite' in state:
secret = service_accounts[account]
subject = None
cfgs = {}
result = {}
error = None
try:
if registered and kitename and secret:
pass
elif is_cname_for and is_cname_ready:
self.ui.Working('Creating your kite')
subject = kitename
result = service.addCnameKite(account, secret, kitename)
time.sleep(2) # Give the service side a moment to replicate...
else:
self.ui.Working('Creating your kite')
subject = register
result = service.addKite(account, secret, register)
time.sleep(2) # Give the service side a moment to replicate...
for be_spec in be_specs:
cfgs.update(self.ArgToBackendSpecs(be_spec % register,
secret=secret))
if is_cname_for == register and 'error' not in result:
subject = kitename
result.update(service.addCnameKite(account, secret, kitename))
error = result.get('error', None)
if not error:
for be_spec in be_specs:
cfgs.update(self.ArgToBackendSpecs(be_spec % kitename,
secret=secret))
except Exception, e:
error = '%s' % e
if error:
self.ui.ExplainError(error, 'Kite creation failed!',
subject=subject)
Goto('abort')
else:
self.ui.Tell(['Success!'])
self.ui.EndWizard()
if autoconfigure: self.backends.update(cfgs)
self.added_kites = True
return (register or kitename, secret)
elif 'manual_abort' in state:
if self.ui.Tell(['Aborted!', '',
'Please manually add information about your',
'kites and front-ends to the configuration file:',
'', ' %s' % self.rcfile],
error=True, back=False) is False:
Back()
else:
self.ui.EndWizard()
if self.ui.ALLOWS_INPUT: return None
sys.exit(0)
elif 'abort' in state:
self.ui.EndWizard()
if self.ui.ALLOWS_INPUT: return None
sys.exit(0)
else:
raise ConfigError('Unknown state: %s' % state)
except KeyboardInterrupt:
sys.stderr.write('\\n')
if history:
Back()
else:
raise KeyboardInterrupt()
self.ui.EndWizard()
return None
def CheckConfig(self):
if self.ui_sspec: self.BindUiSspec()
if not self.servers_manual and not self.servers_auto and not self.isfrontend:
if not self.servers and not self.ui.ALLOWS_INPUT:
raise ConfigError('Nothing to do! List some servers, or run me as one.')
return self
def CheckAllTunnels(self, conns):
missing = []
for backend in self.backends:
proto, domain = backend.split(':')
if not conns.Tunnel(proto, domain):
missing.append(domain)
if missing:
self.FallDown('No tunnel for %s' % missing, help=False)
def Ping(self, host, port):
if self.servers_no_ping: return 0
start = time.time()
try:
fd = rawsocket(socket.AF_INET, socket.SOCK_STREAM)
try:
fd.settimeout(2.0) # Missing in Python 2.2
except Exception:
fd.setblocking(1)
fd.connect((host, port))
fd.send('HEAD / HTTP/1.0\\r\\n\\r\\n')
fd.recv(1024)
fd.close()
except Exception, e:
LogDebug('Ping %s:%s failed: %s' % (host, port, e))
return 100000
elapsed = (time.time() - start)
LogDebug('Pinged %s:%s: %f' % (host, port, elapsed))
return elapsed
def GetHostIpAddr(self, host):
return socket.gethostbyname(host)
def GetHostDetails(self, host):
return socket.gethostbyname_ex(host)
def GetActiveBackends(self):
active = []
for bid in self.backends:
(proto, bdom) = bid.split(':')
if (self.backends[bid][BE_STATUS] not in BE_INACTIVE and
self.backends[bid][BE_SECRET] and
not bdom.startswith('*')):
active.append(bid)
return active
def ChooseFrontEnds(self):
self.servers = []
self.servers_preferred = []
# Enable internal loopback
if self.isfrontend:
need_loopback = False
for be in self.backends.values():
if be[BE_BHOST]:
need_loopback = True
if need_loopback:
self.servers.append(LOOPBACK_FE)
# Convert the hostnames into IP addresses...
for server in self.servers_manual:
(host, port) = server.split(':')
try:
ipaddr = self.GetHostIpAddr(host)
server = '%s:%s' % (ipaddr, port)
if server not in self.servers:
self.servers.append(server)
self.servers_preferred.append(ipaddr)
except Exception, e:
LogDebug('DNS lookup failed for %s' % host)
# Lookup and choose from the auto-list (and our old domain).
if self.servers_auto:
(count, domain, port) = self.servers_auto
# First, check for old addresses and always connect to those.
if not self.servers_new_only:
for bid in self.GetActiveBackends():
(proto, bdom) = bid.split(':')
try:
(hn, al, ips) = self.GetHostDetails(bdom)
for ip in ips:
if not ip.startswith('127.'):
server = '%s:%s' % (ip, port)
if server not in self.servers: self.servers.append(server)
except Exception, e:
LogDebug('DNS lookup failed for %s' % bdom)
try:
(hn, al, ips) = socket.gethostbyname_ex(domain)
times = [self.Ping(ip, port) for ip in ips]
except Exception, e:
LogDebug('Unreachable: %s, %s' % (domain, e))
ips = times = []
while count > 0 and ips:
count -= 1
mIdx = times.index(min(times))
server = '%s:%s' % (ips[mIdx], port)
if server not in self.servers:
self.servers.append(server)
if ips[mIdx] not in self.servers_preferred:
self.servers_preferred.append(ips[mIdx])
del times[mIdx]
del ips[mIdx]
def CreateTunnels(self, conns):
live_servers = conns.TunnelServers()
failures = 0
connections = 0
if len(self.GetActiveBackends()) > 0:
if not self.servers or len(self.servers) > len(live_servers):
self.ChooseFrontEnds()
else:
self.servers_preferred = []
self.servers = []
for server in self.servers:
if server not in live_servers:
if server == LOOPBACK_FE:
LoopbackTunnel.Loop(conns, self.backends)
else:
self.ui.Status('connect', color=self.ui.YELLOW,
message='Connecting to front-end: %s' % server)
if Tunnel.BackEnd(server, self.backends, self.require_all, conns):
Log([('connect', server)])
connections += 1
else:
failures += 1
LogInfo('Failed to connect', [('FE', server)])
self.ui.Notify('Failed to connect to %s' % server,
prefix='!', color=self.ui.YELLOW)
if self.dyndns:
updates = {}
ddns_fmt, ddns_args = self.dyndns
for bid in self.backends.keys():
proto, domain = bid.split(':')
if bid in conns.tunnels:
ips = []
bips = []
for tunnel in conns.tunnels[bid]:
ip = tunnel.server_info[tunnel.S_NAME].split(':')[0]
if not ip == LOOPBACK_HN:
if not self.servers_preferred or ip in self.servers_preferred:
ips.append(ip)
else:
bips.append(ip)
if not ips: ips = bips
if ips:
iplist = ','.join(ips)
payload = '%s:%s' % (domain, iplist)
args = {}
args.update(ddns_args)
args.update({
'domain': domain,
'ip': ips[0],
'ips': iplist,
'sign': signToken(secret=self.backends[bid][BE_SECRET],
payload=payload, length=100)
})
# FIXME: This may fail if different front-ends support different
# protocols. In practice, this should be rare.
update = ddns_fmt % args
if domain not in updates or len(update) < len(updates[domain]):
updates[payload] = update
last_updates = self.last_updates
self.last_updates = []
for update in updates:
if update not in last_updates:
try:
self.ui.Status('dyndns', color=self.ui.YELLOW,
message='Updating DNS...')
result = ''.join(urllib.urlopen(updates[update]).readlines())
self.last_updates.append(update)
if result.startswith('good') or result.startswith('nochg'):
Log([('dyndns', result), ('data', update)])
self.SetBackendStatus(update.split(':')[0],
sub=BE_STATUS_ERR_DNS)
else:
LogInfo('DynDNS update failed: %s' % result, [('data', update)])
self.SetBackendStatus(update.split(':')[0],
add=BE_STATUS_ERR_DNS)
failures += 1
except Exception, e:
LogInfo('DynDNS update failed: %s' % e, [('data', update)])
if DEBUG_IO: traceback.print_exc(file=sys.stderr)
self.SetBackendStatus(update.split(':')[0],
add=BE_STATUS_ERR_DNS)
failures += 1
if not self.last_updates:
self.last_updates = last_updates
return failures
def LogTo(self, filename, close_all=True, dont_close=[]):
global Log
if filename == 'memory':
Log = LogToMemory
filename = self.devnull
elif filename == 'syslog':
Log = LogSyslog
filename = self.devnull
syslog.openlog(self.progname, syslog.LOG_PID, syslog.LOG_DAEMON)
else:
Log = LogToFile
global LogFile
if filename in ('stdio', 'stdout'):
try:
LogFile = os.fdopen(sys.stdout.fileno(), 'w', 0)
except:
LogFile = sys.stdout
else:
try:
LogFile = fd = open(filename, \"a\", 0)
os.dup2(fd.fileno(), sys.stdin.fileno())
os.dup2(fd.fileno(), sys.stdout.fileno())
if not self.ui.WANTS_STDERR: os.dup2(fd.fileno(), sys.stderr.fileno())
except Exception, e:
raise ConfigError('%s' % e)
def Daemonize(self):
# Fork once...
if os.fork() != 0: os._exit(0)
# Fork twice...
os.setsid()
if os.fork() != 0: os._exit(0)
def SelectLoop(self):
global buffered_bytes
conns = self.conns
self.last_loop = time.time()
iready, oready, eready = None, None, None
while self.keep_looping:
isocks, osocks = conns.Readable(), conns.Blocked()
try:
if isocks or osocks:
iready, oready, eready = select.select(isocks, osocks, [], 1.1)
else:
# Windoes does not seem to like empty selects, so we do this instead.
time.sleep(0.5)
except KeyboardInterrupt, e:
raise KeyboardInterrupt()
except Exception, e:
LogError('Error in select: %s (%s/%s)' % (e, isocks, osocks))
conns.CleanFds()
self.last_loop -= 1
now = time.time()
if not iready and not oready:
if (isocks or osocks) and (now < self.last_loop + 1):
LogError('Spinning, pausing ...')
time.sleep(0.1)
if oready:
for socket in oready:
conn = conns.Connection(socket)
if conn and not conn.Send([], try_flush=True):
# LogDebug(\"Write error in main loop, closing %s\" % conn)
conns.Remove(conn)
conn.Cleanup()
if buffered_bytes < 1024 * self.buffer_max:
throttle = None
else:
LogDebug(\"FIXME: Nasty pause to let buffers clear!\")
time.sleep(0.1)
throttle = 1024
if iready:
for socket in iready:
conn = conns.Connection(socket)
if conn and not conn.ReadData(maxread=throttle):
# LogDebug(\"Read error in main loop, closing %s\" % conn)
conns.Remove(conn)
conn.Cleanup()
for conn in conns.DeadConns():
conns.Remove(conn)
conn.Cleanup()
self.last_loop = now
def Loop(self):
self.conns.start()
if self.ui_httpd: self.ui_httpd.start()
if self.tunnel_manager: self.tunnel_manager.start()
if self.ui_comm: self.ui_comm.start()
try:
epoll = select.epoll()
except Exception, msg:
epoll = None
if epoll: LogDebug(\"FIXME: Should try epoll!\")
self.SelectLoop()
def Start(self, howtoquit='CTRL+C = Quit'):
conns = self.conns = self.conns or Connections(self)
global Log
# If we are going to spam stdout with ugly crap, then there is no point
# attempting the fancy stuff. This also makes us backwards compatible
# for the most part.
if self.logfile == 'stdio':
if not self.ui.DAEMON_FRIENDLY: self.ui = NullUi()
# Announce that we've started up!
self.ui.Status('startup', message='Starting up...')
self.ui.Notify(('Hello! This is %s v%s.'
) % (self.progname, APPVER),
prefix='>', color=self.ui.GREEN,
alignright='[%s]' % howtoquit)
config_report = [('started', sys.argv[0]), ('version', APPVER),
('platform', sys.platform),
('argv', ' '.join(sys.argv[1:])),
('ca_certs', self.ca_certs)]
for optf in self.rcfiles_loaded:
config_report.append(('optfile_%s' % optf, 'ok'))
Log(config_report)
if not socks.HAVE_SSL:
self.ui.Notify('SECURITY WARNING: No SSL support was found, tunnels are insecure!',
prefix='!', color=self.ui.WHITE)
self.ui.Notify('Please install either pyOpenSSL or python-ssl.',
prefix='!', color=self.ui.WHITE)
# Create global secret
self.ui.Status('startup', message='Collecting entropy for a secure secret...')
LogInfo('Collecting entropy for a secure secret.')
globalSecret()
self.ui.Status('startup', message='Starting up...')
# Create the UI Communicator
self.ui_comm = UiCommunicator(self, conns)
try:
# Set up our listeners if we are a server.
if self.isfrontend:
self.ui.Notify('This is a PageKite front-end server.')
for port in self.server_ports:
Listener(self.server_host, port, conns)
for port in self.server_raw_ports:
if port != VIRTUAL_PN and port > 0:
Listener(self.server_host, port, conns, connclass=RawConn)
if self.ui_port:
Listener('127.0.0.1', self.ui_port, conns, connclass=UiConn)
# Create the Tunnel Manager
self.tunnel_manager = TunnelManager(self, conns)
except Exception, e:
self.LogTo('stdio')
FlushLogMemory()
if DEBUG_IO: traceback.print_exc(file=sys.stderr)
raise ConfigError('Configuring listeners: %s ' % e)
# Configure logging
if self.logfile:
keep_open = [s.fd.fileno() for s in conns.conns]
if self.ui_httpd: keep_open.append(self.ui_httpd.httpd.socket.fileno())
self.LogTo(self.logfile, dont_close=keep_open)
elif not sys.stdout.isatty():
# Preserve sane behavior when not run at the console.
self.LogTo('stdio')
# Flush in-memory log, if necessary
FlushLogMemory()
# Set up SIGHUP handler.
if self.logfile or self.reloadfile:
try:
import signal
def reopen(x,y):
if self.logfile:
self.LogTo(self.logfile, close_all=False)
LogDebug('SIGHUP received, reopening: %s' % self.logfile)
if self.reloadfile:
self.ConfigureFromFile(self.reloadfile)
signal.signal(signal.SIGHUP, reopen)
except Exception:
LogError('Warning: signal handler unavailable, logrotate will not work.')
# Disable compression in OpenSSL
if socks.HAVE_SSL and not self.enable_sslzlib:
socks.DisableSSLCompression()
# Daemonize!
if self.daemonize:
self.Daemonize()
# Create PID file
if self.pidfile:
pf = open(self.pidfile, 'w')
pf.write('%s\\n' % os.getpid())
pf.close()
# Do this after creating the PID and log-files.
if self.daemonize: os.chdir('/')
# Drop privileges, if we have any.
if self.setgid: os.setgid(self.setgid)
if self.setuid: os.setuid(self.setuid)
if self.setuid or self.setgid:
Log([('uid', os.getuid()), ('gid', os.getgid())])
# Make sure we have what we need
if self.require_all:
self.CreateTunnels(conns)
self.CheckAllTunnels(conns)
# Finally, run our select/epoll loop.
self.Loop()
self.ui.Status('exiting', message='Stopping...')
Log([('stopping', 'pagekite.py')])
if self.ui_httpd: self.ui_httpd.quit()
if self.ui_comm: self.ui_comm.quit()
if self.tunnel_manager: self.tunnel_manager.quit()
if self.conns:
if self.conns.auth: self.conns.auth.quit()
for conn in self.conns.conns: conn.Cleanup()
##[ Main ]#####################################################################
def Main(pagekite, configure, uiclass=NullUi,
progname=None, appver=APPVER,
http_handler=None, http_server=None):
crashes = 1
ui = uiclass()
while True:
pk = pagekite(ui=ui, http_handler=http_handler, http_server=http_server)
try:
try:
try:
configure(pk)
except SystemExit, status:
sys.exit(status)
except Exception, e:
raise ConfigError(e)
pk.Start()
except (ConfigError, getopt.GetoptError), msg:
pk.FallDown(msg)
except KeyboardInterrupt, msg:
pk.FallDown(None, help=False, noexit=True)
return
except SystemExit, status:
sys.exit(status)
except Exception, msg:
traceback.print_exc(file=sys.stderr)
if pk.crash_report_url:
try:
print 'Submitting crash report to %s' % pk.crash_report_url
LogDebug(''.join(urllib.urlopen(pk.crash_report_url,
urllib.urlencode({
'platform': sys.platform,
'appver': APPVER,
'crash': traceback.format_exc()
})).readlines()))
except Exception, e:
print 'FAILED: %s' % e
pk.FallDown(msg, help=False, noexit=pk.main_loop)
# If we get this far, then we're looping. Clean up.
sockets = pk.conns and pk.conns.Sockets() or []
for fd in sockets: fd.close()
# Exponential fall-back.
LogDebug('Restarting in %d seconds...' % (2 ** crashes))
time.sleep(2 ** crashes)
crashes += 1
if crashes > 9: crashes = 9
# No exception, do we keep looping?
if not pk.main_loop: return
def Configure(pk):
if '--appver' in sys.argv:
print '%s' % APPVER
sys.exit(0)
if '--clean' not in sys.argv and '--help' not in sys.argv:
if os.path.exists(pk.rcfile): pk.ConfigureFromFile()
pk.Configure(sys.argv[1:])
if '--settings' in sys.argv:
pk.PrintSettings(safe=True)
sys.exit(0)
if not pk.backends.keys() and (not pk.kitesecret or not pk.kitename):
friendly_mode = (('--friendly' in sys.argv) or
(sys.platform in ('win32', 'os2', 'os2emx',
'darwin', 'darwin1', 'darwin2')))
if '--signup' in sys.argv or friendly_mode:
pk.RegisterNewKite(autoconfigure=True, first=True)
if friendly_mode: pk.save = True
pk.CheckConfig()
if pk.added_kites:
if (pk.autosave or pk.save or
pk.ui.AskYesNo('Save settings to %s?' % pk.rcfile,
default=(len(pk.backends.keys()) > 0))):
pk.SaveUserConfig()
pk.servers_new_only = 'Once'
elif pk.save:
pk.SaveUserConfig(quiet=True)
if ('--list' in sys.argv or
pk.kite_add or pk.kite_remove or pk.kite_only or pk.kite_disable):
pk.ListKites()
sys.exit(0)
"""
sys.modules["pagekite"] = imp.new_module("pagekite")
sys.modules["pagekite"].open = __comb_open
exec __FILES[".SELF/pagekite/__init__.py"] in sys.modules["pagekite"].__dict__
###############################################################################
__FILES[".SELF/pagekite/basicui.py"] = """\
import re, sys, time
import pagekite
from pagekite import NullUi
HTML_BR_RE = re.compile(r'<(br|/p|/li|/tr|/h\\d)>\\s*')
HTML_LI_RE = re.compile(r'
\\s*')
HTML_NBSP_RE = re.compile(r' ')
HTML_TAGS_RE = re.compile(r'<[^>\\s][^>]*>')
def clean_html(text):
return HTML_LI_RE.sub(' * ',
HTML_NBSP_RE.sub('_',
HTML_BR_RE.sub('\\n', text)))
def Q(text):
return HTML_TAGS_RE.sub('', clean_html(text))
class BasicUi(NullUi):
\"\"\"Stdio based user interface.\"\"\"
DAEMON_FRIENDLY = False
WANTS_STDERR = True
EMAIL_RE = re.compile(r'^[a-z0-9!#$%&\\'\\*\\+\\/=?^_`{|}~-]+'
'(?:\\.[a-z0-9!#$%&\\'*+/=?^_`{|}~-]+)*@'
'(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\\.)*'
'(?:[a-zA-Z]{2,4}|museum)$')
def Notify(self, message, prefix=' ',
popup=False, color=None, now=None, alignright=''):
now = int(now or time.time())
color = color or self.NORM
# We suppress duplicates that are either new or still on the screen.
keys = self.notify_history.keys()
if len(keys) > 20:
for key in keys:
if self.notify_history[key] < now-300:
del self.notify_history[key]
message = '%s' % message
if message not in self.notify_history:
# Display the time now and then.
if (not alignright and
(now >= (self.last_tick + 60)) and
(len(message) < 68)):
try:
self.last_tick = now
d = datetime.datetime.fromtimestamp(now)
alignright = '[%2.2d:%2.2d]' % (d.hour, d.minute)
except:
pass # Fails on Python 2.2
self.notify_history[message] = now
msg = '\\r%s %s%s%s%s%s\\n' % ((prefix * 3)[0:3], color, message, self.NORM,
' ' * (75-len(message)-len(alignright)),
alignright)
self.wfile.write(msg)
self.Status(self.status_tag, self.status_msg)
def NotifyMOTD(self, frontend, motd_message):
self.Notify('Message of the day:', prefix=' ++', color=self.WHITE)
lc = 1
for line in Q(motd_message).splitlines():
self.Notify((line.strip() or ' ' * (lc+2)))
lc += 1
self.Notify(' ' * (lc+2), alignright='[from %s]' % frontend)
def Status(self, tag, message=None, color=None):
self.status_tag = tag
self.status_col = color or self.status_col or self.NORM
self.status_msg = '%s' % (message or self.status_msg)
if not self.in_wizard:
message = self.status_msg
msg = ('\\r << pagekite.py [%s]%s %s%s%s\\r%s'
) % (tag, ' ' * (8-len(tag)),
self.status_col, message, ' ' * (52-len(message)), self.NORM)
self.wfile.write(msg)
if tag == 'exiting':
self.wfile.write('\\n')
def Welcome(self, pre=None):
if self.in_wizard:
self.wfile.write('%s%s%s' % (self.CLEAR, self.WHITE, self.in_wizard))
if self.welcome:
self.wfile.write('%s\\r%s\\n' % (self.NORM, Q(self.welcome)))
self.welcome = None
if self.in_wizard and self.wizard_tell:
self.wfile.write('\\n%s\\r' % self.NORM)
for line in self.wizard_tell: self.wfile.write('*** %s\\n' % Q(line))
self.wizard_tell = None
if pre:
self.wfile.write('\\n%s\\r' % self.NORM)
for line in pre: self.wfile.write(' %s\\n' % Q(line))
self.wfile.write('\\n%s\\r' % self.NORM)
def StartWizard(self, title):
self.Welcome()
banner = '>>> %s' % title
banner = ('%s%s[CTRL+C = Cancel]\\n') % (banner, ' ' * (62-len(banner)))
self.in_wizard = banner
self.tries = 200
def Retry(self):
self.tries -= 1
return self.tries
def EndWizard(self):
if self.wizard_tell: self.Welcome()
self.in_wizard = None
if sys.platform in ('win32', 'os2', 'os2emx'):
self.wfile.write('\\n<<< press ENTER to continue >>>\\n')
self.rfile.readline()
def Spacer(self):
self.wfile.write('\\n')
def AskEmail(self, question, default=None, pre=[],
wizard_hint=False, image=None, back=None, welcome=True):
if welcome: self.Welcome(pre)
while self.Retry():
self.wfile.write(' => %s ' % (Q(question), ))
answer = self.rfile.readline().strip()
if default and answer == '': return default
if self.EMAIL_RE.match(answer): return answer
if back is not None and answer == 'back': return back
raise Exception('Too many tries')
def AskLogin(self, question, default=None, email=None, pre=None,
wizard_hint=False, image=None, back=None):
self.Welcome(pre)
def_email, def_pass = default or (email, None)
self.wfile.write(' %s\\n' % (Q(question), ))
if not email:
email = self.AskEmail('Your e-mail:',
default=def_email, back=back, welcome=False)
if email == back: return back
import getpass
self.wfile.write(' => ')
return (email, getpass.getpass() or def_pass)
def AskYesNo(self, question, default=None, pre=[], yes='yes', no='no',
wizard_hint=False, image=None, back=None):
self.Welcome(pre)
yn = ((default is True) and '[Y/n]'
) or ((default is False) and '[y/N]'
) or ('[y/n]')
while self.Retry():
self.wfile.write(' => %s %s ' % (Q(question), yn))
answer = self.rfile.readline().strip().lower()
if default is not None and answer == '': answer = default and 'y' or 'n'
if back is not None and answer.startswith('b'): return back
if answer in ('y', 'n'): return (answer == 'y')
raise Exception('Too many tries')
def AskKiteName(self, domains, question, pre=[], default=None,
wizard_hint=False, image=None, back=None):
self.Welcome(pre)
if len(domains) == 1:
self.wfile.write(('\\n (Note: the ending %s will be added for you.)'
) % domains[0])
else:
self.wfile.write('\\n Please use one of the following domains:\\n')
for domain in domains:
self.wfile.write('\\n *%s' % domain)
self.wfile.write('\\n')
while self.Retry():
self.wfile.write('\\n => %s ' % Q(question))
answer = self.rfile.readline().strip().lower()
if back is not None and answer == 'back':
return back
elif len(domains) == 1:
answer = answer.replace(domains[0], '')
if answer and pagekite.SERVICE_SUBDOMAIN_RE.match(answer):
return answer+domains[0]
else:
for domain in domains:
if answer.endswith(domain):
answer = answer.replace(domain, '')
if answer and pagekite.SERVICE_SUBDOMAIN_RE.match(answer):
return answer+domain
self.wfile.write(' (Please only use characters A-Z, 0-9, - and _.)')
raise Exception('Too many tries')
def AskMultipleChoice(self, choices, question, pre=[], default=None,
wizard_hint=False, image=None, back=None):
self.Welcome(pre)
for i in range(0, len(choices)):
self.wfile.write((' %s %d) %s\\n'
) % ((default==i+1) and '*' or ' ', i+1, choices[i]))
self.wfile.write('\\n')
while self.Retry():
d = default and (', default=%d' % default) or ''
self.wfile.write(' => %s [1-%d%s] ' % (Q(question), len(choices), d))
try:
answer = self.rfile.readline().strip()
if back is not None and answer.startswith('b'): return back
choice = int(answer or default)
if choice > 0 and choice <= len(choices): return choice
except (ValueError, IndexError):
pass
raise Exception('Too many tries')
def Tell(self, lines, error=False, back=None):
if self.in_wizard:
self.wizard_tell = lines
else:
self.Welcome()
for line in lines: self.wfile.write(' %s\\n' % line)
if error: self.wfile.write('\\n')
return True
def Working(self, message):
self.Tell([message])
"""
sys.modules["pagekite.basicui"] = imp.new_module("pagekite.basicui")
sys.modules["pagekite.basicui"].open = __comb_open
sys.modules["pagekite"].basicui = sys.modules["pagekite.basicui"]
exec __FILES[".SELF/pagekite/basicui.py"] in sys.modules["pagekite.basicui"].__dict__
###############################################################################
__FILES[".SELF/pagekite/remoteui.py"] = """\
import re, sys, time
import pagekite
from pagekite import NullUi
class RemoteUi(NullUi):
\"\"\"Stdio based user interface for interacting with other processes.\"\"\"
DAEMON_FRIENDLY = True
ALLOWS_INPUT = True
WANTS_STDERR = True
EMAIL_RE = re.compile(r'^[a-z0-9!#$%&\\'\\*\\+\\/=?^_`{|}~-]+'
'(?:\\.[a-z0-9!#$%&\\'*+/=?^_`{|}~-]+)*@'
'(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\\.)*'
'(?:[a-zA-Z]{2,4}|museum)$')
def __init__(self, welcome=None, wfile=sys.stderr, rfile=sys.stdin):
NullUi.__init__(self, welcome=welcome, wfile=wfile, rfile=rfile)
self.CLEAR = ''
self.NORM = self.WHITE = self.GREY = self.GREEN = self.YELLOW = ''
self.BLUE = self.RED = self.MAGENTA = self.CYAN = ''
def StartListingBackEnds(self):
self.wfile.write('begin_be_list\\n')
def EndListingBackEnds(self):
self.wfile.write('end_be_list\\n')
def NotifyBE(self, bid, be, has_ssl, dpaths, is_builtin=False, now=None):
domain = be[pagekite.BE_DOMAIN]
port = be[pagekite.BE_PORT]
proto = be[pagekite.BE_PROTO]
prox = (proto == 'raw') and ' (HTTP proxied)' or ''
if proto == 'raw' and port in ('22', 22): proto = 'ssh'
url = '%s://%s%s' % (proto, domain, port and (':%s' % port) or '')
message = (' be_status:'
' status=%x; bid=%s; domain=%s; port=%s; proto=%s;'
' bhost=%s; bport=%s%s%s'
'\\n') % (be[pagekite.BE_STATUS], bid, domain, port, proto,
be[pagekite.BE_BHOST], be[pagekite.BE_BPORT],
has_ssl and '; ssl=1' or '',
is_builtin and '; builtin=1' or '')
self.wfile.write(message)
for path in dpaths:
message = (' be_path: domain=%s; port=%s; path=%s; policy=%s; src=%s\\n'
) % (domain, port or 80, path,
dpaths[path][0], dpaths[path][1])
self.wfile.write(message)
def Notify(self, message, prefix=' ',
popup=False, color=None, now=None, alignright=''):
message = '%s' % message
self.wfile.write('notify: %s\\n' % message)
def NotifyMOTD(self, frontend, message):
self.wfile.write('motd: %s %s\\n' % (frontend,
message.replace('\\n', ' ')))
def Status(self, tag, message=None, color=None):
self.status_tag = tag
self.status_msg = '%s' % (message or self.status_msg)
if message:
self.wfile.write('status_msg: %s\\n' % message)
if tag:
self.wfile.write('status_tag: %s\\n' % tag)
def Welcome(self, pre=None):
self.wfile.write('welcome: %s\\n' % (pre or '').replace('\\n', ' '))
def StartWizard(self, title):
self.wfile.write('start_wizard: %s\\n' % title)
def Retry(self):
self.tries -= 1
if self.tries < 0:
raise Exception('Too many tries')
return self.tries
def EndWizard(self):
self.wfile.write('end_wizard: done\\n')
def Spacer(self):
pass
def AskEmail(self, question, default=None, pre=[],
wizard_hint=False, image=None, back=None, welcome=True):
while self.Retry():
self.wfile.write('begin_ask_email\\n')
if pre:
self.wfile.write(' preamble: %s\\n' % '\\n'.join(pre).replace('\\n', ' '))
if default:
self.wfile.write(' default: %s\\n' % default)
self.wfile.write(' question: %s\\n' % (question or '').replace('\\n', ' '))
self.wfile.write(' expect: email\\n')
self.wfile.write('end_ask_email\\n')
answer = self.rfile.readline().strip()
if self.EMAIL_RE.match(answer): return answer
if back is not None and answer == 'back': return back
def AskLogin(self, question, default=None, email=None, pre=None,
wizard_hint=False, image=None, back=None):
while self.Retry():
self.wfile.write('begin_ask_login\\n')
if pre:
self.wfile.write(' preamble: %s\\n' % '\\n'.join(pre).replace('\\n', ' '))
if email:
self.wfile.write(' default: %s\\n' % email)
self.wfile.write(' question: %s\\n' % (question or '').replace('\\n', ' '))
self.wfile.write(' expect: email\\n')
self.wfile.write(' expect: password\\n')
self.wfile.write('end_ask_login\\n')
answer_email = self.rfile.readline().strip()
if back is not None and answer_email == 'back': return back
answer_pass = self.rfile.readline().strip()
if back is not None and answer_pass == 'back': return back
if self.EMAIL_RE.match(answer_email) and answer_pass:
return (answer_email, answer_pass)
def AskYesNo(self, question, default=None, pre=[], yes='Yes', no='No',
wizard_hint=False, image=None, back=None):
while self.Retry():
self.wfile.write('begin_ask_yesno\\n')
if yes:
self.wfile.write(' yes: %s\\n' % yes)
if no:
self.wfile.write(' no: %s\\n' % no)
if pre:
self.wfile.write(' preamble: %s\\n' % '\\n'.join(pre).replace('\\n', ' '))
if default:
self.wfile.write(' default: %s\\n' % default)
self.wfile.write(' question: %s\\n' % (question or '').replace('\\n', ' '))
self.wfile.write(' expect: yesno\\n')
self.wfile.write('end_ask_yesno\\n')
answer = self.rfile.readline().strip().lower()
if back is not None and answer == 'back': return back
if answer in ('y', 'n'): return (answer == 'y')
if answer == str(default).lower(): return default
def AskKiteName(self, domains, question, pre=[], default=None,
wizard_hint=False, image=None, back=None):
while self.Retry():
self.wfile.write('begin_ask_kitename\\n')
if pre:
self.wfile.write(' preamble: %s\\n' % '\\n'.join(pre).replace('\\n', ' '))
for domain in domains:
self.wfile.write(' domain: %s\\n' % domain)
if default:
self.wfile.write(' default: %s\\n' % default)
self.wfile.write(' question: %s\\n' % (question or '').replace('\\n', ' '))
self.wfile.write(' expect: kitename\\n')
self.wfile.write('end_ask_kitename\\n')
answer = self.rfile.readline().strip().lower()
if back is not None and answer == 'back': return back
if answer:
for d in domains:
if answer.endswith(d) or answer.endswith(d): return answer
return answer+domains[0]
def AskBackends(self, kitename, protos, ports, rawports, question, pre=[],
default=None, wizard_hint=False, image=None, back=None):
while self.Retry():
self.wfile.write('begin_ask_backends\\n')
if pre:
self.wfile.write(' preamble: %s\\n' % '\\n'.join(pre).replace('\\n', ' '))
count = 0
if self.server_info:
protos = self.server_info[pagekite.Tunnel.S_PROTOS]
ports = self.server_info[pagekite.Tunnel.S_PORTS]
rawports = self.server_info[pagekite.Tunnel.S_RAW_PORTS]
self.wfile.write(' kitename: %s\\n' % kitename)
self.wfile.write(' protos: %s\\n' % ', '.join(protos))
self.wfile.write(' ports: %s\\n' % ', '.join(ports))
self.wfile.write(' rawports: %s\\n' % ', '.join(rawports))
if default:
self.wfile.write(' default: %s\\n' % default)
self.wfile.write(' question: %s\\n' % (question or '').replace('\\n', ' '))
self.wfile.write(' expect: backends\\n')
self.wfile.write('end_ask_backends\\n')
answer = self.rfile.readline().strip().lower()
if back is not None and answer == 'back': return back
return answer
def AskMultipleChoice(self, choices, question, pre=[], default=None,
wizard_hint=False, image=None, back=None):
while self.Retry():
self.wfile.write('begin_ask_multiplechoice\\n')
if pre:
self.wfile.write(' preamble: %s\\n' % '\\n'.join(pre).replace('\\n', ' '))
count = 0
for choice in choices:
count += 1
self.wfile.write(' choice_%d: %s\\n' % (count, choice))
if default:
self.wfile.write(' default: %s\\n' % default)
self.wfile.write(' question: %s\\n' % (question or '').replace('\\n', ' '))
self.wfile.write(' expect: choice_index\\n')
self.wfile.write('end_ask_multiplechoice\\n')
answer = self.rfile.readline().strip().lower()
try:
ch = int(answer)
if ch > 0 and ch <= len(choices): return ch
except:
pass
if back is not None and answer == 'back': return back
def Tell(self, lines, error=False, back=None):
dialog = error and 'error' or 'message'
self.wfile.write('tell_%s: %s\\n' % (dialog, ' '.join(lines)))
def Working(self, message):
self.wfile.write('working: %s\\n' % message)
"""
sys.modules["pagekite.remoteui"] = imp.new_module("pagekite.remoteui")
sys.modules["pagekite.remoteui"].open = __comb_open
sys.modules["pagekite"].remoteui = sys.modules["pagekite.remoteui"]
exec __FILES[".SELF/pagekite/remoteui.py"] in sys.modules["pagekite.remoteui"].__dict__
###############################################################################
__FILES[".SELF/pagekite/yamond.py"] = """\
#!/usr/bin/python -u
#
# yamond.py, Copyright 2010, The Beanstalks Project ehf.
# http://beanstalks-project.net/
#
# This is a class implementing a flexible metric-store and an HTTP
# thread for browsing the numbers.
#
#############################################################################
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program. If not, see .
#
#############################################################################
#
import getopt
import os
import random
import re
import select
import socket
import struct
import sys
import threading
import time
import traceback
import urllib
import BaseHTTPServer
try:
from urlparse import parse_qs, urlparse
except Exception, e:
from cgi import parse_qs
from urlparse import urlparse
class YamonRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
def do_yamon_vars(self):
self.send_response(200)
self.send_header('Content-Type', 'text/plain')
self.send_header('Cache-Control', 'no-cache')
self.end_headers()
self.wfile.write(self.server.yamond.render_vars_text())
def do_404(self):
self.send_response(404)
self.send_header('Content-Type', 'text/html')
self.end_headers()
self.wfile.write('
')
def handle_path(self, path, query):
if path == '/vars.txt':
self.do_yamon_vars()
elif path == '/':
self.do_root()
else:
self.do_404()
def do_GET(self):
(scheme, netloc, path, params, query, frag) = urlparse(self.path)
qs = parse_qs(query)
return self.handle_path(path, query)
class YamonHttpServer(BaseHTTPServer.HTTPServer):
def __init__(self, yamond, handler):
BaseHTTPServer.HTTPServer.__init__(self, yamond.sspec, handler)
self.yamond = yamond
class YamonD(threading.Thread):
\"\"\"Handle HTTP in a separate thread.\"\"\"
def __init__(self, sspec,
server=YamonHttpServer,
handler=YamonRequestHandler):
threading.Thread.__init__(self)
self.server = server
self.handler = handler
self.sspec = sspec
self.httpd = None
self.running = False
self.values = {}
self.lists = {}
def vmax(self, var, value):
if value > self.values[var]: self.values[var] = value
def vscale(self, var, ratio, add=0):
if var not in self.values: self.values[var] = 0
self.values[var] *= ratio
self.values[var] += add
def vset(self, var, value):
self.values[var] = value
def vadd(self, var, value, wrap=None):
if var not in self.values: self.values[var] = 0
self.values[var] += value
if wrap is not None and self.values[var] >= wrap:
self.values[var] -= wrap
def vmin(self, var, value):
if value < self.values[var]: self.values[var] = value
def vdel(self, var):
if var in self.values: del self.values[var]
def lcreate(self, listn, elems):
self.lists[listn] = [elems, 0, ['' for x in xrange(0, elems)]]
def ladd(self, listn, value):
list = self.lists[listn]
list[2][list[1]] = value
list[1] += 1
list[1] %= list[0]
def render_vars_text(self):
data = []
for var in self.values:
data.append('%s: %s\\n' % (var, self.values[var]))
for lname in self.lists:
(elems, offset, list) = self.lists[lname]
l = list[offset:]
l.extend(list[:offset])
data.append('%s: %s\\n' % (lname, ' '.join(['%s' % x for x in l])))
return ''.join(data)
def quit(self):
if self.httpd:
self.running = False
urllib.urlopen('http://%s:%s/exiting/' % self.sspec,
proxies={}).readlines()
def run(self):
self.httpd = self.server(self, self.handler)
self.sspec = self.httpd.server_address
self.running = True
while self.running: self.httpd.handle_request()
if __name__ == '__main__':
yd = YamonD(('', 0))
yd.vset('bjarni', 100)
yd.lcreate('foo', 2)
yd.ladd('foo', 1)
yd.ladd('foo', 2)
yd.ladd('foo', 3)
yd.run()
"""
sys.modules["pagekite.yamond"] = imp.new_module("pagekite.yamond")
sys.modules["pagekite.yamond"].open = __comb_open
sys.modules["pagekite"].yamond = sys.modules["pagekite.yamond"]
exec __FILES[".SELF/pagekite/yamond.py"] in sys.modules["pagekite.yamond"].__dict__
###############################################################################
__FILES[".SELF/pagekite/httpd.py"] = """\
#!/usr/bin/python -u
#
# pagekite.py, Copyright 2010, 2011, the Beanstalks Project ehf.
# and Bjarni Runar Einarsson
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program. If not, see .
#
#
###############################################################################
import base64
import cgi
from cgi import escape as escape_html
import os
import re
import socket
import sys
import tempfile
import threading
import time
import traceback
import urllib
import SocketServer
from CGIHTTPServer import CGIHTTPRequestHandler
from SimpleXMLRPCServer import SimpleXMLRPCServer, SimpleXMLRPCRequestHandler
import Cookie
import pagekite
import sockschain as socks
##[ Conditional imports & compatibility magic! ]###############################
try:
import datetime
ts_to_date = datetime.datetime.fromtimestamp
except ImportError:
ts_to_date = str
try:
sorted([1, 2, 3])
except:
def sorted(l):
tmp = l[:]
tmp.sort()
return tmp
# Different Python 2.x versions complain about deprecation depending on
# where we pull these from.
try:
from urlparse import parse_qs, urlparse
except ImportError, e:
from cgi import parse_qs
from urlparse import urlparse
try:
import hashlib
def sha1hex(data):
hl = hashlib.sha1()
hl.update(data)
return hl.hexdigest().lower()
except ImportError:
import sha
def sha1hex(data):
return sha.new(data).hexdigest().lower()
##[ PageKite HTTPD code starts here! ]#########################################
class AuthError(Exception):
pass
def fmt_size(count):
if count > 2*(1024*1024*1024):
return '%dGB' % (count / (1024*1024*1024))
if count > 2*(1024*1024):
return '%dMB' % (count / (1024*1024))
if count > 2*(1024):
return '%dKB' % (count / 1024)
return '%dB' % count
class CGIWrapper(CGIHTTPRequestHandler):
def __init__(self, request, path_cgi):
self.path = path_cgi
self.cgi_info = (os.path.dirname(path_cgi),
os.path.basename(path_cgi))
self.request = request
self.server = request.server
self.command = request.command
self.headers = request.headers
self.client_address = ('unknown', 0)
self.rfile = request.rfile
self.wfile = tempfile.TemporaryFile()
def translate_path(self, path): return path
def send_response(self, code, message):
self.wfile.write('X-Response-Code: %s\\r\\n' % code)
self.wfile.write('X-Response-Message: %s\\r\\n' % message)
def send_error(self, code, message):
return self.send_response(code, message)
def Run(self):
self.run_cgi()
self.wfile.seek(0)
return self.wfile
class UiRequestHandler(SimpleXMLRPCRequestHandler):
# Make all paths/endpoints legal, we interpret them below.
rpc_paths = ( )
E403 = { 'code': '403', 'msg': 'Missing', 'mimetype': 'text/html',
'title': '403 Not found',
'body': '
Basic usage, gives `http://localhost:80/` a public name:
$ pagekite NAME.pagekite.me
To expose specific folders, files or use alternate local ports:
$ pagekite /a/path/ NAME.pagekite.me +indexes # built-in HTTPD
$ pagekite *.html NAME.pagekite.me # built-in HTTPD
$ pagekite 3000 NAME.pagekite.me # HTTPD on 3000
To expose multiple local servers (SSH and HTTP):
$ pagekite ssh://NAME.pagekite.me AND 3000 NAME.pagekite.me
## Services and kites ##
The most comman usage of pagekite is as a back-end, where it
is used to expose local services to the outside world.
Examples of services are: a local HTTP server, a local SSH server,
a folder or a file.
A service is exposed by describing it on the command line, along with the
desired public kite name. If a kite name is requested which does not already
exist in the configuration file and program is run interactively, the user
will be prompted and given the option of signing up and/or creating a new
kite using the pagekite.net service.
Multiple services and kites can be specified on a single command-line,
separated by the word 'AND' (note capital letters are required).
This may cause problems if you have many files and folders by that
name, but that should be relatively rare. :-)
## Kite configuration ##
The options --list, --add, --disable and --remove can be used to
manipulate the kites and service definitions in your configuration file,
if you prefer not to edit it by hand. Examples:
Adding new kites
$ pagekite --add /a/path/ NAME.pagekite.me +indexes
$ pagekite --add 80 OTHER-NAME.pagekite.me
To display the current configuration
$ pagekite --list
Disable or delete kites (--add re-enables)
$ pagekite --disable OTHER-NAME.pagekite.me
$ pagekite --remove NAME.pagekite.me
## Flags ##
Flags are used to tune the behavior of a particular kite, for example
by enabling access controls or specific features of the built-in HTTP
server.
### Common flags ###
* +ip/`1.2.3.4`
Enable connections only from this IP address.
* +ip/`1.2.3`
Enable connections only from this /24 netblock.
### HTTP protocol flags ###
* +password/`name`=`pass`
Require a username and password (HTTP Basic Authentication)
* +rewritehost
Rewrite the incoming Host: header.
* +rewritehost=`N`
Replace Host: header value with N.
* +rawheaders
Do not rewrite (or add) any HTTP headers at all.
* +insecure
Allow access to phpMyAdmin, /admin, etc. (per kite).
### Built-in HTTPD flags ###
* +indexes
Enable directory indexes.
* +indexes=`all`
Enable directory indexes including hidden (dot-) files.
* +hide
Obfuscate URLs of shared files.
* +cgi=`list`
A list of extensions, for which files should be treated as
CGI scripts (example: `+cgi=cgi,pl,sh`).
## Options ##
The full power of pagekite lies in the numerous options which
can be specified on the command line or in a configuration file (see below).
Note that many options, especially the service and domain definitions,
are additive and if given multiple options the program will attempt to
obey them all. Options are processed in order and if they are not
additive then the last option will override all preceding ones.
Although pagekite accepts a great many options, most of the
time the program defaults will Just Work.
### Common options ###
* --clean
Skip loading the default configuration file.
* --signup
Interactively sign up for pagekite.net service.
* --defaults
Set defaults for use with pagekite.net service.
* --whitelabel=D
Set defaults for pagekite.net white-labels.
* --whitelabels=D
Set defaults for pagekite.net white-labels (with TLS).
* --nocrashreport
Don't send anonymous crash reports to pagekite.net.
### Back-end options ###
* --shell
Run PageKite in an interactive shell.
* --nullui
Silent UI for scripting. Assumes Yes on all questions.
* --list
List all configured kites.
* --add
Add (or enable) the following kites, save config.
* --remove
Remove the following kites, save config.
* --disable
Disable the following kites, save config.
* --only
Disable all but the following kites, save config.
* --insecure
Allow access to phpMyAdmin, /admin, etc. (global).
* --local=`ports`
Configure for local serving only (no remote front-end).
* --watch=`N`
Display proxied data (higher N = more verbosity).
* --noproxy
Ignore system (or config file) proxy settings.
* --proxy=`type`:`server`:`port`, --socksify=`server`:`port`, --torify=`server`:`port`
Connect to the front-ends using SSL, an HTTP proxy, a SOCKS proxy,
or the Tor anonymity network. The type can be any of 'ssl', 'http'
or 'socks5'. The server name can either be a plain hostname,
user@hostname or user:password@hostname. For SSL connections the
user part may be a path to a client cert PEM file. If multiple
proxies are defined, they will be chained one after another.
* --service_on=`proto`:`kitename`:`host`:`port`:`secret`
Explicit configuration for a service kite. Generally kites are
created on the command-line using the service short-hand
described above, but this syntax is used in the config file.
* --service_off=`proto`:`kitename`:`host`:`port`:`secret`
Same as --service_on, except disabled by default.
* --service_cfg=`...`, --webpath=`...`
These options are used in the configuration file to store service
and flag settings (see above). These are both likely to change in
the near future, so please just pretend you didn't notice them.
* --frontend=`host`:`port`
Connect to the named front-end server. If this option is repeated,
multiple connections will be made.
* --frontends=`num`:`dns-name`:`port`
Choose `num` front-ends from the A records of a DNS domain
name, using the given port number. Default behavior is to probe
all addresses and use the fastest one.
* --nofrontend=`ip`:`port`
Never connect to the named front-end server. This can be used to
exclude some front-ends from auto-configuration.
* --fe_certname=`domain`
Connect using SSL, accepting valid certs for this domain. If
this option is repeated, any of the named certificates will be
accepted, but the first will be preferred.
* --fe_nocertcheck
Connect using SSL/TLS, but do not verify the remote certificate.
This is largely insecure but still thwarts passive attacks and
prevents routers and firewalls from corrupting the PageKite tunnel.
* --ca_certs=`/path/to/file`
Path to your trusted root SSL certificates file.
* --dyndns=`X`
Register changes with DynDNS provider X. X can either be simply
the name of one of the 'built-in' providers, or a URL format
string for ad-hoc updating.
* --keepalive=`N`
Force traffic over idle tunnels every N seconds, to cope with
firewalls that kill idle TCP connections. Backend only: if set
to "auto" (the default), the interval will be adjusted
automatically in response to disconnects.
* --all
Terminate early if any tunnels fail to register.
* --new
Don't attempt to connect to any kites' old front-ends.
* --fingerpath=`P`
Path recipe for the httpfinger back-end proxy.
* --noprobes
Reject all probes for service state.
### Front-end options ###
* --isfrontend
Enable front-end operation.
* --domain=`proto,proto2,pN`:`domain`:`secret`
Accept tunneling requests for the named protocols and specified
domain, using the given secret. A * may be used as a wildcard for
subdomains or protocols.
* --authdomain=`auth-domain`, --authdomain=`target-domain`:`auth-domain`
Use `auth-domain` as a remote authentication server for the
DNS-based authetication protocol. If no target-domain
is given, use this as the default authentication method.
* --motd=`/path/to/motd`
Send the contents of this file to new back-ends as a
"message of the day".
* --host=`hostname`
Listen on the given hostname only.
* --ports=`list`
Listen on a comma-separated list of ports.
* --portalias=`A:B`
Report port A as port B to backends (because firewalls).
* --protos=`list`
Accept the listed protocols for tunneling.
* --rawports=`list`
Listen for raw connections these ports. The string '%s'
allows arbitrary ports in HTTP CONNECT.
* --accept_acl_file=`/path/to/file`
Consult an external access control file before accepting an
incoming connection. Quick'n'dirty for mitigating abuse. The
format is one rule per line: `rule policy comment` where a
rule is an IP or regexp and policy is 'allow' or 'deny'.
* --client_acl=`policy`:`regexp`, --tunnel_acl=`policy`:`regexp`
Add a client connection or tunnel access control rule.
Policies should be 'allow' or 'deny', the regular expression
should be written to match IPv4 or IPv6 addresses. If defined,
access rules are checkd in order and if none matches, incoming
connections will be rejected.
* --tls_default=`name`
Default name to use for SSL, if SNI (Server Name Indication)
is missing from incoming HTTPS connections.
* --tls_endpoint=`name`:`/path/to/file`
Terminate SSL/TLS for a name using key/cert from a file.
### System options ###
* --optfile=`/path/to/file`
Read settings from file X. Default is `~/.pagekite.rc`.
* --optdir=`/path/to/directory`
Read settings from `/path/to/directory/*.rc`, in
lexicographical order.
* --savefile=`/path/to/file`
Saved settings will be written to this file.
* --save
Save the current configuration to the savefile.
* --settings
Dump the current settings to STDOUT, formatted as a configuration
file would be.
* --nozchunks
Disable zlib tunnel compression.
* --sslzlib
Enable zlib compression in OpenSSL.
* --buffers=`N`
Buffer at most N kB of data before blocking.
* --logfile=`F`
Log to file F, `stdio` means standard output.
* --daemonize
Run as a daemon.
* --runas=`U`:`G`
Set UID:GID after opening our listening sockets.
* --pidfile=`P`
Write PID to the named file.
* --errorurl=`U`
URL to redirect to when back-ends are not found.
* --errorurl=`D:U`
Custom error URL for domain D.
* --selfsign
Configure the built-in HTTP daemon for HTTPS, first generating a
new self-signed certificate using openssl if necessary.
* --httpd=`X`:`P`, --httppass=`X`, --pemfile=`X`
Configure the built-in HTTP daemon. These options are likely to
change in the near future, please pretend you didn't see them.
## Configuration files ##
If you are using pagekite as a command-line utility, it will
load its configuration from a file in your home directory. The file is
named `.pagekite.rc` on Unix systems (including Mac OS X), or
`pagekite.cfg` on Windows.
If you are using pagekite as a system-daemon which starts up
when your computer boots, it is generally configured to load settings
from `/etc/pagekite.d/*.rc` (in lexicographical order).
In both cases, the configuration files contain one or more of the same
options as are used on the command line, with the difference that at most
one option may be present on each line, and the parser is more tolerant of
white-space. The leading '--' may also be omitted for readability and
blank lines and lines beginning with '#' are treated as comments.
NOTE: When using -o, --optfile or --optdir on the command line,
it is advisable to use --clean to suppress the default configuration.
## Security ##
Please keep in mind, that whenever exposing a server to the public
Internet, it is important to think about security. Hacked webservers are
frequently abused as part of virus, spam or phishing campaigns and in
some cases security breaches can compromise the entire operating system.
Some advice:
* Switch PageKite off when not using it.
* Use the built-in access controls and SSL encryption.
* Leave the firewall enabled unless you have good reason not to.
* Make sure you use good passwords everywhere.
* Static content is very hard to hack!
* Always, always make frequent backups of any important work.
Note that as of version 0.5, pagekite includes a very basic
request firewall, which attempts to prevent access to phpMyAdmin and
other sensitive systems. If it gets in your way, the +insecure
flag or --insecure option can be used to turn it off.
For more, please visit:
## Bugs ##
Using pagekite as a front-end relay with the native Python SSL
module may result in poor performance. Please use the pyOpenSSL wrappers
instead.
## See Also ##
lapcat(1), ,
## Credits ##
- Bjarni R. Einarsson
- The Beanstalks Project ehf.
- The Rannis Technology Development Fund
- Joar Wandborg
- Luc-Pierre Terral
## Copyright and license ##
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni R. Einarsson.
This program is free software: you can redistribute it and/or modify it
under the terms of the GNU Affero General Public License as published by
the Free Software Foundation, either version 3 of the License, or (at
your option) any later version.
This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public
License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
pagekite-0.5.9.3/doc/CREDITS.txt 0000644 0000000 0000000 00000000347 13232067545 016033 0 ustar root root 0000000 0000000 ## CREDITS ##
FamFamFam Silk Icons by Mark James
Joar Wandborg
Luc-Pierre Terral
## AUTHORS ##
Bjarni Rúnar Einarsson
Már Örlygsson
pagekite-0.5.9.3/doc/README.md 0000644 0000000 0000000 00000110640 13232067545 015452 0 ustar root root 0000000 0000000 # pagekite.py #
PageKite implements a tunneled reverse proxy which makes it easy to make a
service (such as an HTTP or HTTPS server) on localhost visible to the wider
Internet. It also supports other protocols (including SSH), by behaving
as a specialized HTTP proxy.
Try `./pagekite.py --help` for instructions (or read the source).
Managed front-end relay service is available at , or
you can run your own using pagekite.py.
## 0. Table of contents ##
1. [The basics ](#basics)
1. [Requirements ](#req)
2. [Getting started ](#qs)
3. [Configuring from the command line ](#cli)
4. [Terminology, how PageKite works ](#how)
2. [Advanced usage ](#advanced)
1. [Running the back-end, using pagekite.net ](#bes)
2. [Running the back-end, using a custom front-end ](#bec)
3. [Running your own front-end relay ](#fe)
4. [The built-in HTTP server ](#stp)
5. [Coexisting front-ends and other HTTP servers ](#co)
6. [Configuring DNS ](#dns)
7. [Connecting over Socks or Tor ](#tor)
8. [Raw services (HTTP CONNECT) ](#ipr)
9. [SSL/TLS back-ends, endpoints and SNI ](#tls)
10. [Unix/Linux systems integration ](#unx)
11. [Saving your configuration ](#cfg)
12. [A word about security and logs ](#sec)
3. [Limitations, caveats and known bugs ](#lim)
4. [Credits and licence ](#lic)
## 1. The basics ##
### 1.1. Requirements ###
`Pagekite.py` requires Python 2.x, version 2.2 or later.
`Pagekite.py` includes a basic web server for serving static content, but is
more commonly used to expose other HTTP servers running on localhost (such
as Apache or a Django development server) to the wider Internet.
In order for pagekite.py to terminate SSL connections or encrypt the built
in HTTP server, you will need openssl and either python 2.6+ or the pyOpenSSL
module. These are not required if you just want to route HTTPS requests.
You can download pagekite.py from .
**Note:** pagekite.py uses a customized version of SocksiPy (named
SocksipyChain) to handle SSL compatibility and connecting over Tor or
other proxy servers. If you are downloading the "all-in-one" .py file
from , this library is included and built
in. However, you are working with the source code, you will need to
download SocksipyChain. For further details, please see
.
[ [up](#toc) ]
### 1.2. Getting started ###
The quickest way to get started with pagekite.py, is to download a
prebuilt package (combined .py file, .deb or .rpm) from
.
Next, interactively sign up for service with :
pagekite.py --signup
This will ask you for your e-mail address, ask you to choose your initial
kite name (*SOMETHING.pagekite.me*), and then make whatever server you
have running on visible to the outside world as
.
Here are a few useful examples:
# Expose a local HTTP server, but password protect it.
pagekite.py 80 http://FOO.pagekite.me/ +password/guest=foo
# Expose a directory to the web, enabling indexes.
pagekite.py /var/www http://FOO.pagekite.me:8080/ +indexes
# Expose an SSH server to the world.
pagekite.py localhost:22 ssh://FOO.pagekite.me/
The above examples could all be combined into a single command, and the
configuration saved as your default, like so:
pagekite.py --add \
80 http://FOO.pagekite.me +password/guest=foo AND \
/var/www http://BAR.pagekite.me:8080/ +indexes AND \
localhost:22 ssh://FOO.pagekite.me
After running that (admittedly longish) command, you can simply type
`pagekite.py` at any time to make all three services visible to the
Internet. If you have configured multiple services, but only want to
expose one of them, you can use the following short-hand:
pagekite.py FOO.pagekite.me
Please consult the pagekite.net quick-start and wiki for more examples:
*
*
**Note:** If using the .deb or .rpm packages, the command is simply
`pagekite`, not pagekite.py.
[ [up](#toc) ]
### 1.3. Configuring from the command line ###
PageKite knows how to both read and write its own configuration file, which
is usually named `.pagekite.rc` on Linux and the Mac, or `pagekite.cfg` on
Windows.
It is possible to add and remove service definitions from the configuration
file, by using commands like the following:
# Add a service
pagekite.py --add 8000 django-FOO.pagekite.me
# Temporarily disable it
pagekite.py --disable django-FOO.pagekite.me
# List all configured services
pagekite.py --list
# Permanently remove one
pagekite.py --remove django-FOO.pagekite.me
You can also use `--add` to update the configuration of a particular service,
for example to add a `+indexes` flag or access controls.
**Hint:** Another useful flag in this context, is `--nullui`. Making that the
first argument will suppress the normal interactive user interface and simply
assume the answer to all questions is "yes". If you already have valid service
credentials in your configuration file, this can be combined with `--add` to
launch new kites automatically from within a script or other program.
[ [up](#toc) ]
### 1.4. Terminology, how PageKite works ###
PageKite works more or less like this:
1. Your **services**, typically one or more HTTP servers, run on localhost.
2. You run pagekite.py as a **back-end connector**, on the same machine.
3. Another instance of pagekite.py runs as a **front-end relay** on a
machine with a public IP address, in "the cloud".
4. The **back-end** pagekite.py connects to the **front-end**, and
creates a tunnel for the configured **services**.
5. Clients, typically web browsers, connect to the **front-end** and
request **service**. The **front-end** relays the request over the
appropriate tunnel, where the **back-end** forwards it to the actual
server. Responses travel back the same way.
In practice, the back-end is often configured to use multiple front-ends, and
will choose between them based on network latency or other factors. In those
cases it will also update dynamic DNS servers to direct your services' DNS
names to the IP address of the front-end server.
If the connection to the front-end is lost, the back-end will attempt to
re-establish a connection, either with the same server or another one.
#### Terminology ####
The following terms are use throughout the rest of this document:
* A **service** is a local server, for example a website or SSH server.
* A **front-end** is an instance of pagekite.py which is configured to act
as a public, client-facing visible relay server.
* A **back-end** is an instance of pagekite.py which is configured to
establish and maintain the tunnels and DNS records required to make a local
**service** visible to the wider Internet. The **back-end** must be able
to make direct connections to local servers.
* A **service** which is exposed to the wider Internet using PageKite is
sometimes called **a kite**.
To avoid confusion, we prefer not to use the terms "client" and "server" to
describe the different roles of pagekite.py.
[ [up](#toc) ]
## 2. Advanced usage ##
In this chapter, the more esoteric features of PageKite will be explored.
Note that many of these topics are only relevant to people who are running
their own PageKite front-end relay servers.
In all examples below, the long-form `--argument=foo` syntax is used, for
precision and for compatibility with the PageKite configuration file.
Note that in release 0.4.7, the `--backend` argument was renamed to
`--service_on`. This document uses the new name, although the old one is
still recognized by the program and will be for the forseeable future.
### 2.1. Running the back-end, using pagekite.net ###
The most common use of pagekite.py, is to make a web server visible to
the outside world. Assuming you are using the pagekite.net service and
your web server runs on port 80, a command like this should get you up
and running:
backend$ pagekite.py \
--defaults \
--service_on=http:YOURNAME:localhost:80:SECRET
Replace YOURNAME with your PageKite domain name (for example
*something.pagekite.me*) and SECRET with the shared secret displayed on
your account page.
You can add multiple service specifications, one for each name and protocol
you wish to expose. Here is an example running two websites, one of which
is available using three protocols: HTTP, HTTPS and WebSocket.
backend$ pagekite.py \
--defaults \
--service_on=http:YOURNAME:localhost:80:SECRET \
--service_on=https:YOURNAME:localhost:443:SECRET \
--service_on=http:OTHERNAME:localhost:8080:SECRET
Alternately, if you want to expose different HTTP services on different ports
for the same domain name, you can include port numbers in your service specs:
backend$ pagekite.py \
--defaults \
--service_on=http/80:YOURNAME:localhost:80:SECRET \
--service_on=http/8080:YOURNAME:localhost:8080:SECRET
Note that this really only works for HTTP. Also, which ports are actually
available depends on the front-end, and the protocol must still be one
supported by PageKite (HTTP, HTTPS or WebSocket).
[ [up](#toc) ]
### 2.2. Running the back-end, using a custom front-end ###
If you prefer to run your own front-ends, you will need to follow the
instructions in this section on your back-ends, and the instructions in
the next section on your front-end.
When running your own front-end, you need to tell pagekite.py where it
is, using the `--frontend` argument:
backend$ pagekite.py \
--frontend=HOST:PORT \
--service_on=http:YOURNAME:localhost:80:YOURSECRET
Replace HOST with the DNS name or IP address of your front-end, and PORT
with one of the ports it listens for connections on. If your front-end
supports TLS-encrypted tunnels, add the --fe_certname=HOST argument as well.
[ [up](#toc) ]
### 2.3. Running your own front-end relay ###
To configure pagekite.py as a front-end relay, you will need to have a
host with a publicly visible IP address, and you will need to configure
DNS correctly, [as discussed below](#dns).
Assuming you are not already running a web server on that machine, the
optimal configuration is to run pagekite.py so it listens on a few ports
(80 and 443 at least), like so:
frontend$ sudo pagekite.py \
--isfrontend \
--ports=80,443 --protos=http,https \
--domain=http,https:YOURNAME:YOURSECRET
In this case, YOURNAME must be a DNS name which points to the IP of the
front-end relay (either an A or CNAME record), and YOURSECRET is a
shared secret of your choosing - it has to match on the back-end, or the
connection will be rejected.
Perceptive readers will have noticed a few problems with this though.
One, is that you are running pagekite.py as root, which is generally
frowned upon by those concerned with security. Another, is you have only
enabled a single back-end, which is a bit limited.
The second problem is easily addressed, as the `--domain` parameter will
accept wild-cards, and of course you can have as many `--domain` parameters
as you like. So something like this might make sense:
frontend$ sudo pagekite.py \
--isfrontend \
--ports=80,443,8080 --protos=http,https \
--domain=http,https:*.YOURDOMAIN.COM:YOURSECRET \
--domain=http,https:*.YOUROTHERDOMAIN.NET:YOUROTHERSECRET
Unfortunately, root permissions are required in order to bind ports 80
and 443, but it is possible to instruct pagekite.py to drop all privileges
as soon as possible, like so:
frontend$ sudo pagekite.py \
--isfrontend \
--runas=nobody:nogroup \
--ports=80,443,8080 --protos=http,https \
--domain=http,https:YOURNAME:YOURSECRET
This assumes the *nobody* user and *nogroup* group exist on your system.
Replace with other values as necessary. See the section on [Unix/Linux
systems integration](#unx) for more useful flags for running a production
pagekite.py.
[ [up](#toc) ]
### 2.4. The built-in HTTP server ###
*FIXME: Write this.*
#### Enabling SSL in the built-in HTTP server ####
If you have the OpenSSL (pyOpenSSL or python 2.6+), you can increase the
security of your HTTP console even further by creating a self-signed
SSL certificate and enabling it using the `--pemfile` option:
backend$ pagekite.py \
--defaults \
--pemfile=cert.pem \
...
To generate a self-signed certificate:
openssl req -new -x509 \
-keyout cert.pem -out cert.pem \
-days 365 -nodes
Note that your browser will complain when you first visit the console
and you will have to add a security exception in order to access the page.
[ [up](#toc) ]
### 2.5. Coexisting front-ends and other HTTP servers ###
What to do if you already have a web server running on the machine you want
to use as a PageKite front-end? Generally only one process can run on a
given IP:PORT pair, which is why this poses a problem.
The simplest solution, is to get another IP address for the machine, and
use one for pagekite.py, and the other for your web-server. In that case
you would add the `--host=IP` argument to your pagekite.py configuration.
If, however, you have to share a single IP, things get slightly more
complicated. Either the web-server will have to forward connections to
pagekite.py, or the other way around.
#### pagekite.py on port 80 (recommended) ####
As of pagekite.py 0.3.6, it is possible for front-ends to have direct local
back-ends, so just letting pagekite.py have port 80 (and 443) is the simplest
way to get the two to coexist:
1. Move your old web-server to another port (such as 8080)
2. Configure pagekite.py [as a front-end](#fe) on port 80
3. Add `--service_on` specifications for your old web-server.
As of 0.3.14, you can make pagekite.py use a local back-end as a catch-all
for any unrecongized domains, by using the special hostname "unknown" in
the `--service_on` line (remember to specify a protocol).
For example:
frontend$ sudo pagekite.py \
--isfrontend \
--runas=nobody:nogroup \
--ports=80,443 --protos=http,https \
--domain=http,https:YOURNAME:YOURSECRET \
--service_on=http:OLDNAME:localhost:8080: \
--service_on=https:OLDNAME:localhost:8443: \
--service_on=https:unknown:localhost:8090:
Note that no password is required for configuring local back-ends.
#### Another HTTP server on port 80 ####
The other option, assuming your web-server supports proxying, is to configure
it to proxy requests for your PageKite domains to pagekite.py, and run
pagekite.py on an alternate port. How this is done depends on your HTTP
server software, but Apache and lighttpd at least are both capable of
forwarding requests to alternate ports.
This is likely to work in many cases for standard HTTP traffic, but very
unlikely to work for HTTPS.
**Warning:** If you have more than one domain behind PageKite, it is
of critical importance that the HTTP server *not* re-use the same proxy
connection for multiple requests. For performance and compatibility
reasons, pagekite.py does not currently continue parsing the HTTP/1.1
request stream once it has chosen a back-end: it blindly forwards packets
back and forth. This means that if the web server proxy code sends a request
for *a.foo.com* first, and then requests *b.foo.com* over the same
connection, the second request will be routed to the wrong back-end.
Unfortunately, this means putting pagekite.py behind a high-performance
load-balancer may cause unpredictable (and quite undesirable) results:
Varnish at least is known to cause problems in this configuration.
Please send reports of success (or failure) configuring pagekite.py behind
another HTTP server, proxy or load-balancer to our Google Group:
.
[ [up](#toc) ]
### 2.6. Configuring DNS ###
In order for your PageKite websites to be visible to the wider Internet,
you will have to make sure DNS records for them are properly configured.
If you are using the pagekite.net service, this is handled automatically
by a dynamic DNS server, but if you are running your own front-end, then
you may need to take some additional steps.
#### Static DNS configuration ####
Generally if you have a single fixed front-end, you can simply use a static
DNS entry, either an A record or a CNAME, linking your site's domain name
to the IP address of **the machine running the front-end**.
So, if the front-end's name is *foo.com* with the IP address *1.2.3.4*, and
your website is *blah.foo.com*, then you would need to configure the DNS
record for *blah.foo.com* as a CNAME to *foo.com* or an A record to *1.2.3.4*.
This is the same kind of configuration as if your front-end were a normal
web host.
Alternately, it might be useful to set up a wildcard DNS record for the
domain *foo.com*, directing all unspecified names to your front-end. That,
combined with the wildcard `--domain` argument described [above](#fe), will
give you the flexibility to trivially create as many PageKite websites
as you like, just by changing arguments to the [back-end](#bec).
#### Dynamic DNS configuration ####
This all gets a bit more complicated if you are running multiple front-ends,
and letting the back-end choose between them based on ping times (this is
the `--default` behavior does when using the PageKite service).
First of all, the back-end will need a way to receive the list of available
front-ends. Secondly, the back-end will need to be able to dynamically update
the DNS records for the sites it is connecting.
The list of front-ends should be provided to pagekite.py as a DNS name
with multiple A records. As an example, the default for the PageKite
service, is the name **frontends.b5p.us**:
$ host frontends.b5p.us
frontends.b5p.us has address 69.164.211.158
frontends.b5p.us has address 93.95.226.149
frontends.b5p.us has address 178.79.140.143
...
When started up with a `--frontends` argument (note the trailing s),
pagekite.py will measure the distance of each of these IP addresses and
pick the one closest. (It will also perform DNS lookups on its own name
and connect to any old back-ends as well, to guarantee reachability while
the old DNS records expire.)
Pagekite.py has built-in support for most of the common dynamic DNS
providers, which can be accessed via. the `--dyndns` flag. Assuming you were
using `dyndns.org`, running the back-end like this might work in that case:
backend$ pagekite.py \
--frontends=1:YOUR.FRONTENDS.COM:443 \
--dyndns=USER:PASS@dyndns.org \
--service_on=http:YOURNAME.dyndns.org:localhost:80:YOURSECRET
Instead of dyndns.org above, pagekite.py also has built-in support for
no-ip.com and of course pagekite.net. Other providers can be used by
providing a full HTTP or HTTPS URL, with the following python formatting
tokens in the appropriate places:
%(ip)s - will be replaced by your new front-end IP address
%(domain)s - will be replaced by your domain name
This example argument manually implements no-ip.com support (split between
lines for readability):
--dyndns='https://USER:PASS@dynupdate.no-ip.com/nic/update?
hostname=%(domain)s&myip=%(ip)s'
[ [up](#toc) ]
### 2.7. Connecting over Socks or Tor ###
If you want to run pagekite.py from behind a restrictive firewall which
does not even allow outgoing connections, you might be able to work around
the problem by using a Socks proxy.
Alternately, if you are concerned about anonymity and want to hide your
IP even from the person running the front-end, you might want to connect
using the [Tor](https://www.torproject.org/) network.
For these situations, you can use the `--torify` or `--socksify` arguments,
like so:
backend$ pagekite.py \
--defaults \
--socksify=SOCKSHOST:PORT \
--service_on=http:YOURNAME:localhost:80:YOURSECRET
In the case of Tor, replace `--socksify` with `--torify` and (probably)
connect to localhost, on port 9050.
With `--torify`, some behavior is modified slightly in order to avoid leaking
information about which domains you are hosting through DNS side channels.
[ [up](#toc) ]
### 2.8. Raw services (HTTP CONNECT) ###
Pagekite.py version 0.3.7 added the "raw" protocol, which allows you to
bind a back-end to a raw port. This may be useful for all sorts of things,
but was primarily designed as a "good enough" hack for tunneling SSH
connections.
As the pagekite.py front-end, and all the ports it listens on, are assumed
to be shared by multiple back-ends, raw ports do not work like normal ports,
they must be accessed using an HTTP Proxy CONNECT request.
To expose a raw service, use a command like so:
backend$ pagekite.py \
--defaults \
--service_on=raw/22:YOURNAME:localhost:22:SECRET \
...
This means you can place more or less any server behind PageKite, as long as
the client can be configured to use an HTTP Proxy to connect: simply configure
the client to use the PageKite front-end (and a normal port, not a raw port)
as an HTTP Proxy.
As an example, the following lines in **.ssh/config** provide reliable direct
access to an SSH server exposed via. pagekite.py and the pagekite.net service:
Host HOME.pagekite.me
CheckHostIP no
ProxyCommand /bin/nc -X connect -x HOME.pagekite.me:443 %h %p
**Note:** The old 'RAW-after-HTTP' method is deprecated and no longer
supported. It has therefore been removed from this manual.
[ [up](#toc) ]
### 2.9. SSL/TLS back-ends, endpoints and SNI ###
Pagekite.py includes powerful support for name-based virtual hosting of
multiple encrypted (HTTPS) web-sites behind a single IP address, something
which until recently was practically largely impossible.
This is done based on the new TLS/SNI extension, along with some work-arounds
for older clients (see Limitations below).
#### Encrypted back-ends (end-to-end) ####
The most secure use of TLS involves encrypted back-ends, registered with a
`--service_on=https:NAME:...` argument.
These back-ends themselves take care of the encryption and decryption, so
all pagekite.py sees is an incomprehensible stream of binary - this is as
secure as it gets!
How to obtain certificates and configure your back-ends is outside the
scope of this document.
#### Encrypted tunnels ####
As of pagekite.py version 0.3.8, it is possible to connect to the front-end
using a TLS-encrypted tunnel.
This is much more secure and is highly recommended: not only does this
prevent people from sniffing the traffic between your web server and the
front-end, it also protects you against any man-in-the-middle attacks where
someone impersonates your front-end of choice.
This requires additional configuration both on the front-end and on the back.
On the front-end, you need to define a TLS endpoint (and certificate) for
the domain of the SSL certificate (it does not actually have to match the
domain name of the front-end, but the front- and back-ends have to agree
what the certificate name is).
frontend$ sudo pagekite.py \
...
--tls_endpoint=frontend.domain.com:/path/to/key-and-cert-chain.pem \
...
On the back-end, you need to tell pagekite.py which certificate to
accept, and possibly give it the path to [a list of certificate authority
certificates](http://curl.haxx.se/ca/cacert.pem) (the default works on Linux).
backend$ pagekite.py \
--frontend=frontend.domain.com:443 \
--fe_certname=frontend.domain.com \
--ca_certs=/path/to/ca-certificates.pem \
...
#### Creating your own key and certificate (for tunnels) ####
Note that if you are running your own front-end, you do not need to purchase
a commecial certificate for this to work - you can generate your own
self-signed certificate and use that on both ends (this will actually be
*more* secure than using a 3rd party certificate). To generate a certificate
and a key, run this:
openssl req -new -x509 \
-keyout site-key.pem -out site-cert.pem \
-days 365 -nodes
OpenSSL will ask a few questions - you can answer them in any way you like,
it does not really matter. For use on the server, the key and certificate
must be combined into a single file, like so:
cat site-key.pem site-cert.pem > frontend.pem
This frontend.pem file you would then configure as a TLS endpoint on the
front-end, and a copy of site-cert.pem would be distributed to all the
back-ends and used with the `--ca_certs` parameter.
#### Encrypting unencrypted back-ends ####
If you want to enable encryption for back-ends which do not themselves
support HTTPS, you can use the `--tls_endpoint` flag to ask pagekite.py
itself to handle TLS for a given domain.
In this configuration, clients will communicate securely with the
pagekite.py front-end, which will in turn forward decrypted requests to its
backends, encrypting any replies as they are sent to the client.
As the tunnel between pagekite front- and back-ends itself is generally
encapsulated in a secure TLS connection, this provides almost the same level
of security as end-to-end encryption above, with the exception that the
pagekite.py front-end has access to unencrypted data. So back-ends have to
trust the person running their front-end!
Although not perfect, for those concerned with casual snooping on shared
public WiFi, school or corporate networks, this is a significant security
benefit.
The expected use-case for this feature, is to deploy a wild-card certificate
at the front-end, allowing multiple back-ends to encrypt their communication
without the administrative overhead of generating, distributing and
maintaining keys and certificates on every single one. An example:
frontend$ sudo pagekite.py \
--isfrontend \
--ports=80,443 --protos=http,https \
--tls_endpoint=frontend.domain.com:/tunnel/key-and-cert-chain.pem \
--tls_endpoint=*.domain.com:/path/to/key-and-cert-chain.pem \
--domain=http:*.domain.com:SECRET
backend$ sudo pagekite.py \
--frontend=frontend.domain.com:443 \
--fe_certname=frontend.domain.com \
--service_on=http:foo.domain.com:localhost:80:SECRET
This would enable both https://foo.domain.com/ and http://foo.domain.com/,
without an explicit https back-end being defined or configured - but the
tunnel between the back- and front-ends will be encrypted using TLS and
the *frontend.domain.com* certificate.
**Note:** Currently SSL endpoints are only available at the front-end, but
will be available on the back-end as well in a future release.
**Note:** This requires either pyOpenSSL or python 2.6+ and openssl support
at the OS level.
#### Limitations ####
Windows XP (and older) ships with an implementation of the HTTPS (TLS)
protocol which does not support the SNI extension. The same is true for
certain older browsers under Linux (such as lynx), Android 1.6, and
generally any old or poorly maintained HTTPS clients.
Without SNI, pagekite.py can not reliably detect which domain is being
requested. In its absence, pagekite.py employs the following fall-back
strategies to facilitate access:
1. Obey the TLS/SNI extension, if present.
2. Check if any known back-end was recently visited by the client IP,
if one is found, try to use that for the domain.
3. Fall back to a default domain specified by the `--tls_default` flag.
This means the common pattern of a clear-text HTTP website "upgrading" to
HTTPS on certain pages is quite likely to work even for older browsers. But
it is *not* guaranteed if the guest IP address is shared by multiple users,
or if the browser is idle for too long (so the SSL connection times out and
the IP expires from the tracking map maintained by pagekite.py).
When the above measures all fail and the wrong domain is chosen for routing
the TLS request, browsers should detect a certificate mismatch and abort the
request. So although inconvenient and not very user-friendly, this failure
mode should not pose a significant security risk.
The best solution is of course to upgrade all browsers accessing your site to
a recent version of Chrome, which includes proper SNI support.
As this may not be realistic, it might be wise want to provide an unencrypted
(HTTP) version of your website for older clients, upgrading to HTTPS only when
it has been verified to work; this can be done by fetching a javascript
upgrade script from the HTTPS version of your site.
[ [up](#toc) ]
### 2.10. Unix/Linux systems integration ###
When deploying pagekite.py as a system component on Unix, there are quite
a few specialized arguments which can come in handy.
In addtion to `--runas` and `--host` (discussed above), pagekite.py
understands these: `--pidfile`, `--logfile` and `--daemonize`, each of
which does more or less what you would expect. Special cases worth noting
are `--logfile=syslog`, which instead of writing to a file, logs to the system
log service and `--logfile=stdio` which logs to standard output.
Putting these all together, a real production invocation of pagekite.py at
the front-end might look something like this:
frontend$ sudo pagekite.py \
--runas=nobody:nogroup \
--pidfile=/var/run/pagekite.pid \
--logfile=syslog \
--daemonize \
--isfrontend \
--host=1.2.3.4 \
--ports=80,443 \
--protos=http,https \
--domain=http,https:*.YOURDOMAIN.COM:YOURSECRET \
--domain=http,https:*.YOUROTHERDOMAIN.NET:YOUROTHERSECRET
That is quite a lot of arguments! So please read on, and learn how to
generate a configuration file...
[ [up](#toc) ]
### 2.11. Saving your configuration ###
Once you have everything up and running properly, you may find it more
convenient to save the settings to a configuration file. Pagekite.py can
generate the configuration file for you: just add `--settings` to **the very
end** of the command line and save the output to a file. On Linux or OS X,
that might look something like this:
$ pagekite.py \
--defaults \
--service_on=http:YOURNAME:localhost:80:SECRET \
--settings \
| tee ~/.pagekite.rc
The default configuration file on Linux and Mac OS X is `~/.pagekite.rc`, on
Windows it is usually either `C:\\Users\\USERNAME\\pagekite.cfg` or
`C:\\Documents and Settings\\USERNAME\\pagekite.cfg`.
If you save your settings to this location, they will be loaded by default
whenever you run pagekite.py - which may not always be what you want if you
are experimenting. To *skip* the configuration file, you can use the
`--clean` argument, and to load an alternate configuration, you can use
`--optfile`. Combining both, you might end up with something like this:
$ pagekite.py --clean --optfile=/etc/pagekite.cfg
The `--optfile` option can be used within configuration files as well, if
you want to "include" a one configuration into another for some reason.
[ [up](#toc) ]
### 2.12. A word about security and logs ###
When exposing services to the wider Internet, as pagekite.py is designed to
do, it is always important to keep some basic security principles in mind.
Pagekite.py itself should be quite secure - it never invokes any external
processes and the only modifications it makes to the file-system are the
log-files it writes.
The main security concern is your HTTP server, which you are exposing to
the wider Internet. Covering general web server security is out of scope for
this brief manual, but there is one important difference between running a
web server on a public host and running one through PageKite:
Just like most other reverse proxies, PageKite will make your logs "look
funny" and may break certain forms of naive access control. This is because
from the point of view of your web server, all connections that travel over
PageKite will appear to originate from **localhost**, with the IP address
127.0.0.1. **This will break any access controls based on IP addresses.**
For logging purposes, the HTTP and WebSocket protocols, the "standard"
X-Forwarded-For header is added to initial requests (if HTTP 1.1 persistent
connections are used, subsequent requests may be lacking the header), in all
cases pagekite.py will report the actual remote IP in its own log.
[ [up](#toc) ]
## 3. Limitations, caveats and known bugs ##
There are certain limitations to what can be accomplished using Pagekite, due
to the nature of the underlying protocls. Here is a brief discussion of the
most important ones.
#### HTTPS routing and Windows XP ###
HTTPS support depends on recent additions to the TLS protocol, which are
unsupported by older browsers and operating systems - most importantly
including the still common Windows XP.
The mechanisms employed by pagekite.py to work around these problems are
discussed in [the TLS/SSL section](#tls).
#### Raw ports ###
Raw ports are unreliable for clients sharing IP addresses with others or
accessing multiple resources behind the same front-end at the same time.
See the discussed in [the raw port section](#ipr) for details and instructions
on how to reliably configure clients to use the HTTP CONNECT method to work
around this limitation.
[ [up](#toc) ]
## 4. Credits and licence ##
Please see individual files for details on their licensing; as a rule
Python source code falls under the same license as pagekite.py,
documentation (including this document) under the Creative Commons
Attribution-ShareAlike (CC-BY-SA) 3.0, and sample configuration files are
placed in the Public Domain.
If these licensing terms to not suit you for some reason, please contact
the authors as it may be possible to negotiate alternate terms.
#### This document ####
This document is (C) Copyright 2010-2012, Bjarni Rúnar Einarsson and The
Beanstalks Project ehf.
This work is licensed under the Creative Commons Attribution-ShareAlike
3.0 Unported License. To view a copy of this license, visit
or send a letter to
Creative Commons, 171 Second Street, Suite 300, San Francisco,
California, 94105, USA.
#### pagekite.py ####
Pagekite.py is (C) Copyright 2010-2012, Bjarni Rúnar Einarsson and The
Beanstalks Project ehf.
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see .
[ [up](#toc) ]
pagekite-0.5.9.3/TODO.md 0000644 0000000 0000000 00000005651 13232067545 014522 0 ustar root root 0000000 0000000 # TODOS #
## Known bugs ##
* PageKite frontends will disconnect tunnels when kites run out of quota.
This will hurt Kazz.am, should recheck all kites and only disable out of
quota ones, disconnecting only when all run out. Also, UI issues.
* XML-RPC CNAME creation fail
* Signup message weirdness
* Poor handling of reconfiguration
* Poor handling of FD exhaustion
* Kite creation can be confusing if a name is already taken.
* WONTFIX: SSL verification fail - unfixable with pyOpenSSL :-(
## Code cleanup ##
* Files are still too big, github chokes
* Function naming is inconsistent
* Need docstrings all over pagekite source
* Unneeded ( ) in a few places
* Bad form: if this: thenfoo
## General ##
* 0.5.x: Add UI to report available upgrades at the back-end.
* 0.5.x: Windows: Auto upgrades?
## Built-in HTTPD ##
* 0.5: Allow uploading, somehow
* 0.5: Allow access controls based on OpenID/Twitter/Facebook ?
* 0.5: Create javascript for making directory listings prettier
* Add basic photo albums
* Add feature to thumbnail/preview/re-encode images/audio/video
## Packaging ##
* 0.5: Create Windows distribution
* 0.5: Create Windows .msi
* 0.6: Package lapcat
* 0.6: Create Mac OS X GUI and package: Talk to Sveinbjörn?
### Optimization ###
* Add QoS and bandwidth shaping
* Add a scheduler for deferred/periodic processing
* Replace string concatenation ops with lists of buffers
### Protocols ###
* Make tunnel creation more stubborn, try multiple ports, etc.
* Add XMPP and incoming SMTP support
* Replace/augment current tunnel auth with SSL certificates
### Better kite registration ###
1. Quota calculations should be done on a kite-by-kite basis:
- kites out of quota get disabled
- tunnels only die if they have *no* live/challenged kites left
3. Stop requiring the reconnect after a challenge, just establish
a tunnel with zero kites?
2. Registration
- recognize the challenge/response headers within chunk headers,
so kite can be set up using NOOP chunks.
- add a back-end initiated "remove this kite" message
### Dynamic DNS ###
Dynamic DNS updates are the only SPoF left in the PageKite.net service,
should fix by:
* Modify pagekite.py to update multiple (all) update servers
### Lame-duck ###
Lame-duck mode is when a front-end knows it can no longer handle traffic
but still has established user connections. The goal is to shut down as
quickly as possible, without dropping (too much) traffic.
* Trigger on: normal shutdown, out of FDs, OOM, uncaught exceptions
* Add signaling to tunnels to warn that FE is lame.
* Shut down all listening sockets and daemonize so new FE can start up
* Implement protocol for sending entire live tunnel to new FE process?
* Give existing conns 60 seconds to finish?
* Add "lame" recognition in back-end (also "rejected")
pagekite-0.5.9.3/pagekite_gtk.py 0000777 0000000 0000000 00000000000 13232067574 022503 2scripts/pagekite_gtk ustar root root 0000000 0000000 pagekite-0.5.9.3/COPYING 0000644 0000000 0000000 00000103330 13232067545 014457 0 ustar root root 0000000 0000000 GNU AFFERO GENERAL PUBLIC LICENSE
Version 3, 19 November 2007
Copyright (C) 2007 Free Software Foundation, Inc.
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The GNU Affero General Public License is a free, copyleft license for
software and other kinds of works, specifically designed to ensure
cooperation with the community in the case of network server software.
The licenses for most software and other practical works are designed
to take away your freedom to share and change the works. By contrast,
our General Public Licenses are intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.
Developers that use our General Public Licenses protect your rights
with two steps: (1) assert copyright on the software, and (2) offer
you this License which gives you legal permission to copy, distribute
and/or modify the software.
A secondary benefit of defending all users' freedom is that
improvements made in alternate versions of the program, if they
receive widespread use, become available for other developers to
incorporate. Many developers of free software are heartened and
encouraged by the resulting cooperation. However, in the case of
software used on network servers, this result may fail to come about.
The GNU General Public License permits making a modified version and
letting the public access it on a server without ever releasing its
source code to the public.
The GNU Affero General Public License is designed specifically to
ensure that, in such cases, the modified source code becomes available
to the community. It requires the operator of a network server to
provide the source code of the modified version running there to the
users of that server. Therefore, public use of a modified version, on
a publicly accessible server, gives the public access to the source
code of the modified version.
An older license, called the Affero General Public License and
published by Affero, was designed to accomplish similar goals. This is
a different license, not a version of the Affero GPL, but Affero has
released a new version of the Affero GPL which permits relicensing under
this license.
The precise terms and conditions for copying, distribution and
modification follow.
TERMS AND CONDITIONS
0. Definitions.
"This License" refers to version 3 of the GNU Affero General Public License.
"Copyright" also means copyright-like laws that apply to other kinds of
works, such as semiconductor masks.
"The Program" refers to any copyrightable work licensed under this
License. Each licensee is addressed as "you". "Licensees" and
"recipients" may be individuals or organizations.
To "modify" a work means to copy from or adapt all or part of the work
in a fashion requiring copyright permission, other than the making of an
exact copy. The resulting work is called a "modified version" of the
earlier work or a work "based on" the earlier work.
A "covered work" means either the unmodified Program or a work based
on the Program.
To "propagate" a work means to do anything with it that, without
permission, would make you directly or secondarily liable for
infringement under applicable copyright law, except executing it on a
computer or modifying a private copy. Propagation includes copying,
distribution (with or without modification), making available to the
public, and in some countries other activities as well.
To "convey" a work means any kind of propagation that enables other
parties to make or receive copies. Mere interaction with a user through
a computer network, with no transfer of a copy, is not conveying.
An interactive user interface displays "Appropriate Legal Notices"
to the extent that it includes a convenient and prominently visible
feature that (1) displays an appropriate copyright notice, and (2)
tells the user that there is no warranty for the work (except to the
extent that warranties are provided), that licensees may convey the
work under this License, and how to view a copy of this License. If
the interface presents a list of user commands or options, such as a
menu, a prominent item in the list meets this criterion.
1. Source Code.
The "source code" for a work means the preferred form of the work
for making modifications to it. "Object code" means any non-source
form of a work.
A "Standard Interface" means an interface that either is an official
standard defined by a recognized standards body, or, in the case of
interfaces specified for a particular programming language, one that
is widely used among developers working in that language.
The "System Libraries" of an executable work include anything, other
than the work as a whole, that (a) is included in the normal form of
packaging a Major Component, but which is not part of that Major
Component, and (b) serves only to enable use of the work with that
Major Component, or to implement a Standard Interface for which an
implementation is available to the public in source code form. A
"Major Component", in this context, means a major essential component
(kernel, window system, and so on) of the specific operating system
(if any) on which the executable work runs, or a compiler used to
produce the work, or an object code interpreter used to run it.
The "Corresponding Source" for a work in object code form means all
the source code needed to generate, install, and (for an executable
work) run the object code and to modify the work, including scripts to
control those activities. However, it does not include the work's
System Libraries, or general-purpose tools or generally available free
programs which are used unmodified in performing those activities but
which are not part of the work. For example, Corresponding Source
includes interface definition files associated with source files for
the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.
The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.
The Corresponding Source for a work in source code form is that
same work.
2. Basic Permissions.
All rights granted under this License are granted for the term of
copyright on the Program, and are irrevocable provided the stated
conditions are met. This License explicitly affirms your unlimited
permission to run the unmodified Program. The output from running a
covered work is covered by this License only if the output, given its
content, constitutes a covered work. This License acknowledges your
rights of fair use or other equivalent, as provided by copyright law.
You may make, run and propagate covered works that you do not
convey, without conditions so long as your license otherwise remains
in force. You may convey covered works to others for the sole purpose
of having them make modifications exclusively for you, or provide you
with facilities for running those works, provided that you comply with
the terms of this License in conveying all material for which you do
not control copyright. Those thus making or running the covered works
for you must do so exclusively on your behalf, under your direction
and control, on terms that prohibit them from making any copies of
your copyrighted material outside their relationship with you.
Conveying under any other circumstances is permitted solely under
the conditions stated below. Sublicensing is not allowed; section 10
makes it unnecessary.
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under article
11 of the WIPO copyright treaty adopted on 20 December 1996, or
similar laws prohibiting or restricting circumvention of such
measures.
When you convey a covered work, you waive any legal power to forbid
circumvention of technological measures to the extent such circumvention
is effected by exercising rights under this License with respect to
the covered work, and you disclaim any intention to limit operation or
modification of the work as a means of enforcing, against the work's
users, your or third parties' legal rights to forbid circumvention of
technological measures.
4. Conveying Verbatim Copies.
You may convey verbatim copies of the Program's source code as you
receive it, in any medium, provided that you conspicuously and
appropriately publish on each copy an appropriate copyright notice;
keep intact all notices stating that this License and any
non-permissive terms added in accord with section 7 apply to the code;
keep intact all notices of the absence of any warranty; and give all
recipients a copy of this License along with the Program.
You may charge any price or no price for each copy that you convey,
and you may offer support or warranty protection for a fee.
5. Conveying Modified Source Versions.
You may convey a work based on the Program, or the modifications to
produce it from the Program, in the form of source code under the
terms of section 4, provided that you also meet all of these conditions:
a) The work must carry prominent notices stating that you modified
it, and giving a relevant date.
b) The work must carry prominent notices stating that it is
released under this License and any conditions added under section
7. This requirement modifies the requirement in section 4 to
"keep intact all notices".
c) You must license the entire work, as a whole, under this
License to anyone who comes into possession of a copy. This
License will therefore apply, along with any applicable section 7
additional terms, to the whole of the work, and all its parts,
regardless of how they are packaged. This License gives no
permission to license the work in any other way, but it does not
invalidate such permission if you have separately received it.
d) If the work has interactive user interfaces, each must display
Appropriate Legal Notices; however, if the Program has interactive
interfaces that do not display Appropriate Legal Notices, your
work need not make them do so.
A compilation of a covered work with other separate and independent
works, which are not by their nature extensions of the covered work,
and which are not combined with it such as to form a larger program,
in or on a volume of a storage or distribution medium, is called an
"aggregate" if the compilation and its resulting copyright are not
used to limit the access or legal rights of the compilation's users
beyond what the individual works permit. Inclusion of a covered work
in an aggregate does not cause this License to apply to the other
parts of the aggregate.
6. Conveying Non-Source Forms.
You may convey a covered work in object code form under the terms
of sections 4 and 5, provided that you also convey the
machine-readable Corresponding Source under the terms of this License,
in one of these ways:
a) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by the
Corresponding Source fixed on a durable physical medium
customarily used for software interchange.
b) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by a
written offer, valid for at least three years and valid for as
long as you offer spare parts or customer support for that product
model, to give anyone who possesses the object code either (1) a
copy of the Corresponding Source for all the software in the
product that is covered by this License, on a durable physical
medium customarily used for software interchange, for a price no
more than your reasonable cost of physically performing this
conveying of source, or (2) access to copy the
Corresponding Source from a network server at no charge.
c) Convey individual copies of the object code with a copy of the
written offer to provide the Corresponding Source. This
alternative is allowed only occasionally and noncommercially, and
only if you received the object code with such an offer, in accord
with subsection 6b.
d) Convey the object code by offering access from a designated
place (gratis or for a charge), and offer equivalent access to the
Corresponding Source in the same way through the same place at no
further charge. You need not require recipients to copy the
Corresponding Source along with the object code. If the place to
copy the object code is a network server, the Corresponding Source
may be on a different server (operated by you or a third party)
that supports equivalent copying facilities, provided you maintain
clear directions next to the object code saying where to find the
Corresponding Source. Regardless of what server hosts the
Corresponding Source, you remain obligated to ensure that it is
available for as long as needed to satisfy these requirements.
e) Convey the object code using peer-to-peer transmission, provided
you inform other peers where the object code and Corresponding
Source of the work are being offered to the general public at no
charge under subsection 6d.
A separable portion of the object code, whose source code is excluded
from the Corresponding Source as a System Library, need not be
included in conveying the object code work.
A "User Product" is either (1) a "consumer product", which means any
tangible personal property which is normally used for personal, family,
or household purposes, or (2) anything designed or sold for incorporation
into a dwelling. In determining whether a product is a consumer product,
doubtful cases shall be resolved in favor of coverage. For a particular
product received by a particular user, "normally used" refers to a
typical or common use of that class of product, regardless of the status
of the particular user or of the way in which the particular user
actually uses, or expects or is expected to use, the product. A product
is a consumer product regardless of whether the product has substantial
commercial, industrial or non-consumer uses, unless such uses represent
the only significant mode of use of the product.
"Installation Information" for a User Product means any methods,
procedures, authorization keys, or other information required to install
and execute modified versions of a covered work in that User Product from
a modified version of its Corresponding Source. The information must
suffice to ensure that the continued functioning of the modified object
code is in no case prevented or interfered with solely because
modification has been made.
If you convey an object code work under this section in, or with, or
specifically for use in, a User Product, and the conveying occurs as
part of a transaction in which the right of possession and use of the
User Product is transferred to the recipient in perpetuity or for a
fixed term (regardless of how the transaction is characterized), the
Corresponding Source conveyed under this section must be accompanied
by the Installation Information. But this requirement does not apply
if neither you nor any third party retains the ability to install
modified object code on the User Product (for example, the work has
been installed in ROM).
The requirement to provide Installation Information does not include a
requirement to continue to provide support service, warranty, or updates
for a work that has been modified or installed by the recipient, or for
the User Product in which it has been modified or installed. Access to a
network may be denied when the modification itself materially and
adversely affects the operation of the network or violates the rules and
protocols for communication across the network.
Corresponding Source conveyed, and Installation Information provided,
in accord with this section must be in a format that is publicly
documented (and with an implementation available to the public in
source code form), and must require no special password or key for
unpacking, reading or copying.
7. Additional Terms.
"Additional permissions" are terms that supplement the terms of this
License by making exceptions from one or more of its conditions.
Additional permissions that are applicable to the entire Program shall
be treated as though they were included in this License, to the extent
that they are valid under applicable law. If additional permissions
apply only to part of the Program, that part may be used separately
under those permissions, but the entire Program remains governed by
this License without regard to the additional permissions.
When you convey a copy of a covered work, you may at your option
remove any additional permissions from that copy, or from any part of
it. (Additional permissions may be written to require their own
removal in certain cases when you modify the work.) You may place
additional permissions on material, added by you to a covered work,
for which you have or can give appropriate copyright permission.
Notwithstanding any other provision of this License, for material you
add to a covered work, you may (if authorized by the copyright holders of
that material) supplement the terms of this License with terms:
a) Disclaiming warranty or limiting liability differently from the
terms of sections 15 and 16 of this License; or
b) Requiring preservation of specified reasonable legal notices or
author attributions in that material or in the Appropriate Legal
Notices displayed by works containing it; or
c) Prohibiting misrepresentation of the origin of that material, or
requiring that modified versions of such material be marked in
reasonable ways as different from the original version; or
d) Limiting the use for publicity purposes of names of licensors or
authors of the material; or
e) Declining to grant rights under trademark law for use of some
trade names, trademarks, or service marks; or
f) Requiring indemnification of licensors and authors of that
material by anyone who conveys the material (or modified versions of
it) with contractual assumptions of liability to the recipient, for
any liability that these contractual assumptions directly impose on
those licensors and authors.
All other non-permissive additional terms are considered "further
restrictions" within the meaning of section 10. If the Program as you
received it, or any part of it, contains a notice stating that it is
governed by this License along with a term that is a further
restriction, you may remove that term. If a license document contains
a further restriction but permits relicensing or conveying under this
License, you may add to a covered work material governed by the terms
of that license document, provided that the further restriction does
not survive such relicensing or conveying.
If you add terms to a covered work in accord with this section, you
must place, in the relevant source files, a statement of the
additional terms that apply to those files, or a notice indicating
where to find the applicable terms.
Additional terms, permissive or non-permissive, may be stated in the
form of a separately written license, or stated as exceptions;
the above requirements apply either way.
8. Termination.
You may not propagate or modify a covered work except as expressly
provided under this License. Any attempt otherwise to propagate or
modify it is void, and will automatically terminate your rights under
this License (including any patent licenses granted under the third
paragraph of section 11).
However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly and
finally terminates your license, and (b) permanently, if the copyright
holder fails to notify you of the violation by some reasonable means
prior to 60 days after the cessation.
Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you have
received notice of violation of this License (for any work) from that
copyright holder, and you cure the violation prior to 30 days after
your receipt of the notice.
Termination of your rights under this section does not terminate the
licenses of parties who have received copies or rights from you under
this License. If your rights have been terminated and not permanently
reinstated, you do not qualify to receive new licenses for the same
material under section 10.
9. Acceptance Not Required for Having Copies.
You are not required to accept this License in order to receive or
run a copy of the Program. Ancillary propagation of a covered work
occurring solely as a consequence of using peer-to-peer transmission
to receive a copy likewise does not require acceptance. However,
nothing other than this License grants you permission to propagate or
modify any covered work. These actions infringe copyright if you do
not accept this License. Therefore, by modifying or propagating a
covered work, you indicate your acceptance of this License to do so.
10. Automatic Licensing of Downstream Recipients.
Each time you convey a covered work, the recipient automatically
receives a license from the original licensors, to run, modify and
propagate that work, subject to this License. You are not responsible
for enforcing compliance by third parties with this License.
An "entity transaction" is a transaction transferring control of an
organization, or substantially all assets of one, or subdividing an
organization, or merging organizations. If propagation of a covered
work results from an entity transaction, each party to that
transaction who receives a copy of the work also receives whatever
licenses to the work the party's predecessor in interest had or could
give under the previous paragraph, plus a right to possession of the
Corresponding Source of the work from the predecessor in interest, if
the predecessor has it or can get it with reasonable efforts.
You may not impose any further restrictions on the exercise of the
rights granted or affirmed under this License. For example, you may
not impose a license fee, royalty, or other charge for exercise of
rights granted under this License, and you may not initiate litigation
(including a cross-claim or counterclaim in a lawsuit) alleging that
any patent claim is infringed by making, using, selling, offering for
sale, or importing the Program or any portion of it.
11. Patents.
A "contributor" is a copyright holder who authorizes use under this
License of the Program or a work on which the Program is based. The
work thus licensed is called the contributor's "contributor version".
A contributor's "essential patent claims" are all patent claims
owned or controlled by the contributor, whether already acquired or
hereafter acquired, that would be infringed by some manner, permitted
by this License, of making, using, or selling its contributor version,
but do not include claims that would be infringed only as a
consequence of further modification of the contributor version. For
purposes of this definition, "control" includes the right to grant
patent sublicenses in a manner consistent with the requirements of
this License.
Each contributor grants you a non-exclusive, worldwide, royalty-free
patent license under the contributor's essential patent claims, to
make, use, sell, offer for sale, import and otherwise run, modify and
propagate the contents of its contributor version.
In the following three paragraphs, a "patent license" is any express
agreement or commitment, however denominated, not to enforce a patent
(such as an express permission to practice a patent or covenant not to
sue for patent infringement). To "grant" such a patent license to a
party means to make such an agreement or commitment not to enforce a
patent against the party.
If you convey a covered work, knowingly relying on a patent license,
and the Corresponding Source of the work is not available for anyone
to copy, free of charge and under the terms of this License, through a
publicly available network server or other readily accessible means,
then you must either (1) cause the Corresponding Source to be so
available, or (2) arrange to deprive yourself of the benefit of the
patent license for this particular work, or (3) arrange, in a manner
consistent with the requirements of this License, to extend the patent
license to downstream recipients. "Knowingly relying" means you have
actual knowledge that, but for the patent license, your conveying the
covered work in a country, or your recipient's use of the covered work
in a country, would infringe one or more identifiable patents in that
country that you have reason to believe are valid.
If, pursuant to or in connection with a single transaction or
arrangement, you convey, or propagate by procuring conveyance of, a
covered work, and grant a patent license to some of the parties
receiving the covered work authorizing them to use, propagate, modify
or convey a specific copy of the covered work, then the patent license
you grant is automatically extended to all recipients of the covered
work and works based on it.
A patent license is "discriminatory" if it does not include within
the scope of its coverage, prohibits the exercise of, or is
conditioned on the non-exercise of one or more of the rights that are
specifically granted under this License. You may not convey a covered
work if you are a party to an arrangement with a third party that is
in the business of distributing software, under which you make payment
to the third party based on the extent of your activity of conveying
the work, and under which the third party grants, to any of the
parties who would receive the covered work from you, a discriminatory
patent license (a) in connection with copies of the covered work
conveyed by you (or copies made from those copies), or (b) primarily
for and in connection with specific products or compilations that
contain the covered work, unless you entered into that arrangement,
or that patent license was granted, prior to 28 March 2007.
Nothing in this License shall be construed as excluding or limiting
any implied license or other defenses to infringement that may
otherwise be available to you under applicable patent law.
12. No Surrender of Others' Freedom.
If conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot convey a
covered work so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you may
not convey it at all. For example, if you agree to terms that obligate you
to collect a royalty for further conveying from those to whom you convey
the Program, the only way you could satisfy both those terms and this
License would be to refrain entirely from conveying the Program.
13. Remote Network Interaction; Use with the GNU General Public License.
Notwithstanding any other provision of this License, if you modify the
Program, your modified version must prominently offer all users
interacting with it remotely through a computer network (if your version
supports such interaction) an opportunity to receive the Corresponding
Source of your version by providing access to the Corresponding Source
from a network server at no charge, through some standard or customary
means of facilitating copying of software. This Corresponding Source
shall include the Corresponding Source for any work covered by version 3
of the GNU General Public License that is incorporated pursuant to the
following paragraph.
Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU General Public License into a single
combined work, and to convey the resulting work. The terms of this
License will continue to apply to the part which is the covered work,
but the work with which it is combined will remain governed by version
3 of the GNU General Public License.
14. Revised Versions of this License.
The Free Software Foundation may publish revised and/or new versions of
the GNU Affero General Public License from time to time. Such new versions
will be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the
Program specifies that a certain numbered version of the GNU Affero General
Public License "or any later version" applies to it, you have the
option of following the terms and conditions either of that numbered
version or of any later version published by the Free Software
Foundation. If the Program does not specify a version number of the
GNU Affero General Public License, you may choose any version ever published
by the Free Software Foundation.
If the Program specifies that a proxy can decide which future
versions of the GNU Affero General Public License can be used, that proxy's
public statement of acceptance of a version permanently authorizes you
to choose that version for the Program.
Later license versions may give you additional or different
permissions. However, no additional obligations are imposed on any
author or copyright holder as a result of your choosing to follow a
later version.
15. Disclaimer of Warranty.
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. Limitation of Liability.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.
17. Interpretation of Sections 15 and 16.
If the disclaimer of warranty and limitation of liability provided
above cannot be given local legal effect according to their terms,
reviewing courts shall apply local law that most closely approximates
an absolute waiver of all civil liability in connection with the
Program, unless a warranty or assumption of liability accompanies a
copy of the Program in return for a fee.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
state the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
Copyright (C)
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see .
Also add information on how to contact you by electronic and paper mail.
If your software can interact with users remotely through a computer
network, you should also make sure that it provides a way for users to
get its source. For example, if your program is a web application, its
interface could display a "Source" link that leads users to an archive
of the code. There are many ways you could offer source, and different
solutions will be better for different programs; see section 13 for the
specific requirements.
You should also get your employer (if you work as a programmer) or school,
if any, to sign a "copyright disclaimer" for the program, if necessary.
For more information on this, and how to apply and follow the GNU AGPL, see
.
pagekite-0.5.9.3/MANIFEST.in 0000644 0000000 0000000 00000000430 13232067545 015157 0 ustar root root 0000000 0000000 include pk *.py *.md *.txt *.sample *.1 Makefile COPYING
recursive-include pagekite *.py
recursive-include scripts *
recursive-include doc *
recursive-include rpm *
recursive-include gui *
recursive-include etc *
exclude *.pyc
exclude socks.py
exclude sockschain.py
exclude .SELF
pagekite-0.5.9.3/pagekite/ 0000755 0000000 0000000 00000000000 13232067643 015214 5 ustar root root 0000000 0000000 pagekite-0.5.9.3/pagekite/common.py 0000755 0000000 0000000 00000012736 13232067545 017073 0 ustar root root 0000000 0000000 """
Constants and global program state.
"""
##############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
##############################################################################
import random
import time
PROTOVER = '0.8'
APPVER = '0.5.9.3'
AUTHOR = 'Bjarni Runar Einarsson, http://bre.klaki.net/'
WWWHOME = 'https://pagekite.net/'
LICENSE_URL = 'http://www.gnu.org/licenses/agpl.html'
MAGIC_PREFIX = '/~:PageKite:~/'
MAGIC_PATH = '%sv%s' % (MAGIC_PREFIX, PROTOVER)
MAGIC_PATHS = (MAGIC_PATH, '/Beanstalk~Magic~Beans/0.2')
MAGIC_UUID = '%x-%x-%s' % (random.randint(0, 0xfffffff), time.time(), APPVER)
SERVICE_PROVIDER = 'PageKite.net'
SERVICE_DOMAINS = ('pagekite.me', '302.is', 'testing.is', 'kazz.am')
SERVICE_DOMAINS_SIGNUP = ('pagekite.me',)
SERVICE_XMLRPC = 'http://pagekite.net/xmlrpc/'
SERVICE_TOS_URL = 'https://pagekite.net/humans.txt'
SERVICE_CERTS = ['b5p.us', 'frontends.b5p.us', 'pagekite.net', 'pagekite.me',
'pagekite.com', 'pagekite.org', 'testing.is', '302.is']
# Places to search for the CA Certificate bundle
OS_CA_CERTS = (
"/etc/pki/tls/certs/ca-bundle.crt", # Fedora/RHEL
"/etc/ssl/certs/ca-certificates.crt", # Debian/Ubuntu/Gentoo etc.
"/etc/ssl/ca-bundle.pem", # OpenSUSE
"/etc/pki/tls/cacert.pem", # OpenELEC
"/etc/ssl/cert.pem", # OpenBSD
"/usr/local/share/certs/ca-root-nss.crt", # FreeBSD/DragonFly
"/usr/local/etc/openssl/cert.pem", # OS X (Homebrew)
"/opt/local/etc/openssl/cert.pem", # OS X (Ports?)
"/system/etc/security/cacerts") # Android
CURL_CA_CERTS = 'https://curl.haxx.se/ca/cacert.pem'
DEFAULT_CHARSET = 'utf-8'
DEFAULT_BUFFER_MAX = 1024
AUTH_ERRORS = '255.255.255.'
AUTH_ERR_USER_UNKNOWN = '.0'
AUTH_ERR_INVALID = '.1'
AUTH_QUOTA_MAX = '255.255.254.255'
VIRTUAL_PN = 'virtual'
CATCHALL_HN = 'unknown'
LOOPBACK_HN = 'loopback'
LOOPBACK_FE = LOOPBACK_HN + ':1'
LOOPBACK_BE = LOOPBACK_HN + ':2'
LOOPBACK = {'FE': LOOPBACK_FE, 'BE': LOOPBACK_BE}
# Re-evaluate our choice of frontends every 45-60 minutes.
FE_PING_INTERVAL = (45 * 60) + random.randint(0, 900)
# This is a global count of disconnect errors; we use this
# to adjust the ping interval over time.
DISCONNECT_COUNT = 0
PING_INTERVAL_MIN = 20
PING_INTERVAL = 116 # Not quite 2 minutes... :-)
PING_INTERVAL_MOBILE = 1800
PING_INTERVAL_MAX = 1800
PING_GRACE_DEFAULT = 40
PING_GRACE_MIN = 5
WEB_POLICY_DEFAULT = 'default'
WEB_POLICY_PUBLIC = 'public'
WEB_POLICY_PRIVATE = 'private'
WEB_POLICY_OTP = 'otp'
WEB_POLICIES = (WEB_POLICY_DEFAULT, WEB_POLICY_PUBLIC,
WEB_POLICY_PRIVATE, WEB_POLICY_OTP)
WEB_INDEX_ALL = 'all'
WEB_INDEX_ON = 'on'
WEB_INDEX_OFF = 'off'
WEB_INDEXTYPES = (WEB_INDEX_ALL, WEB_INDEX_ON, WEB_INDEX_OFF)
BE_PROTO = 0
BE_PORT = 1
BE_DOMAIN = 2
BE_BHOST = 3
BE_BPORT = 4
BE_SECRET = 5
BE_STATUS = 6
BE_STATUS_REMOTE_SSL = 0x0010000
BE_STATUS_OK = 0x0001000
BE_STATUS_ERR_DNS = 0x0000100
BE_STATUS_ERR_BE = 0x0000010
BE_STATUS_ERR_TUNNEL = 0x0000001
BE_STATUS_ERR_ANY = 0x0000fff
BE_STATUS_UNKNOWN = 0
BE_STATUS_DISABLED = 0x8000000
BE_STATUS_DISABLE_ONCE = 0x4000000
BE_INACTIVE = (BE_STATUS_DISABLED, BE_STATUS_DISABLE_ONCE)
BE_NONE = ['', '', None, None, None, '', BE_STATUS_UNKNOWN]
DYNDNS = {
'pagekite.net': ('http://up.pagekite.net/'
'?hostname=%(domain)s&myip=%(ips)s&sign=%(sign)s'),
'beanstalks.net': ('http://up.b5p.us/'
'?hostname=%(domain)s&myip=%(ips)s&sign=%(sign)s'),
'whitelabel': ('http://dnsup.%s/'
'?hostname=%%(domain)s&myip=%%(ips)s&sign=%%(sign)s'),
'whitelabels': ('https://dnsup.%s/'
'?hostname=%%(domain)s&myip=%%(ips)s&sign=%%(sign)s'),
'dyndns.org': ('https://%(user)s:%(pass)s@members.dyndns.org'
'/nic/update?wildcard=NOCHG&backmx=NOCHG'
'&hostname=%(domain)s&myip=%(ip)s'),
'no-ip.com': ('https://%(user)s:%(pass)s@dynupdate.no-ip.com'
'/nic/update?hostname=%(domain)s&myip=%(ip)s'),
}
# Create our service-domain matching regexp
import re
SERVICE_DOMAIN_RE = re.compile('\.(' + '|'.join(SERVICE_DOMAINS) + ')$')
SERVICE_SUBDOMAIN_RE = re.compile(r'^([A-Za-z0-9_-]+\.)*[A-Za-z0-9_-]+$')
class ConfigError(Exception):
"""This error gets thrown on configuration errors."""
class ConnectError(Exception):
"""This error gets thrown on connection errors."""
class BugFoundError(Exception):
"""Throw this anywhere a bug is detected and we want a crash."""
##[ Ugly fugly globals ]#######################################################
# The global Yamon is used for measuring internal state for monitoring
gYamon = None
# Status of our buffers...
buffered_bytes = [0]
pagekite-0.5.9.3/pagekite/__main__.py 0000755 0000000 0000000 00000040436 13232067545 017321 0 ustar root root 0000000 0000000 #!/usr/bin/env python
"""
This is the pagekite.py Main() function.
"""
##############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
##############################################################################
import sys
from pagekite import pk
from pagekite import httpd
if __name__ == "__main__":
if hasattr(sys.stdout, 'isatty') and sys.stdout.isatty():
import pagekite.ui.basic
uiclass = pagekite.ui.basic.BasicUi
else:
import pagekite.ui.nullui
uiclass = pagekite.ui.nullui.NullUi
pk.Main(pk.PageKite, pk.Configure,
uiclass=uiclass,
http_handler=httpd.UiRequestHandler,
http_server=httpd.UiHttpServer)
##############################################################################
CERTS="""\
COMODO Certification Authority Bundle
=====================================
-----BEGIN CERTIFICATE-----
MIIE/DCCA+SgAwIBAgIQFpDDKbZ4BgdRHwWwNEhGyzANBgkqhkiG9w0BAQUFADBv
MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
eHRlcm5hbCBDQSBSb290MB4XDTEwMDQxNjAwMDAwMFoXDTIwMDUzMDEwNDgzOFow
gYkxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO
BgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMS8wLQYD
VQQDEyZDT01PRE8gSGlnaC1Bc3N1cmFuY2UgU2VjdXJlIFNlcnZlciBDQTCCASIw
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOeH2sB35Ls6+mokyIBBrNIWExU9
+vf4KnbcqC05CM5ISr4PffDeurtH1b0t1xurDyCBIwhyscARlQ3m6qmH/8duHk9m
MrpTvAWqHCwM7003R2sQDNvFoJh+WNs31q7pBr3XqGXzN7nHbc53xybg13QfppgW
uwxryL530O9YpymgubhpBTbLstpYowt1rT2LIoIgPnCGmRy5T893pAcaI2PROFaE
7L+PxU70GJabGuiT7I2vFZwk8Fo76A+5qFoB07IcYMmcUgTdkqf+DKziRY0DYbx5
4Hcuh0E8WF/L9cV38ljITSjQmvrzcwkkaHS8IEzYLLCq6NlObfKMJNOTXZECAwEA
AaOCAXcwggFzMB8GA1UdIwQYMBaAFK29mHo0tCb3+sQmVO8DveAky1QaMB0GA1Ud
DgQWBBQ/1bXQ1kR5UEoXo5uMSty4sCJkazAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0T
AQH/BAgwBgEB/wIBADARBgNVHSAECjAIMAYGBFUdIAAwRAYDVR0fBD0wOzA5oDeg
NYYzaHR0cDovL2NybC51c2VydHJ1c3QuY29tL0FkZFRydXN0RXh0ZXJuYWxDQVJv
b3QuY3JsMIGzBggrBgEFBQcBAQSBpjCBozA/BggrBgEFBQcwAoYzaHR0cDovL2Ny
dC51c2VydHJ1c3QuY29tL0FkZFRydXN0RXh0ZXJuYWxDQVJvb3QucDdjMDkGCCsG
AQUFBzAChi1odHRwOi8vY3J0LnVzZXJ0cnVzdC5jb20vQWRkVHJ1c3RVVE5TR0ND
QS5jcnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJ
KoZIhvcNAQEFBQADggEBABOFH1KAGMlT9/4uGq/M2Qs8wtOFgRDwKI25QH4sno/W
NoYKTBQt1pdDkkEZN0uWnuupMHkSlbMCNlftK7kdmBqjGAo/mzmLzaFJKUwv+dCV
jMhNlbqoQ88zqiUqWg6qJ8lOa7Hmcx+zdATD80ziqOtnt124CAUaVppUKYX1KU6A
O5XQe1OWEVbBAtPqsn/Kj5xwShSNWrkWYHXWzSceFs1bM455QM8oSOfccRZOdJF1
uSqM8XCsJt0EuUDChd4ck0DQzG7Dm6rvYGXfYCLwWqV6oi/kcHPuPNQmK2gHwSB6
6JhaPnufAotiwIWBgGA1fqUdDNKc32JFDdv8N/v1JSI=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIENjCCAx6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJTRTEU
MBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFs
IFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290
MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFowbzELMAkGA1UEBhMCU0Ux
FDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5h
bCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9v
dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALf3GjPm8gAELTngTlvt
H7xsD821+iO2zt6bETOXpClMfZOfvUq8k+0DGuOPz+VtUFrWlymUWoCwSXrbLpX9
uMq/NzgtHj6RQa1wVsfwTz/oMp50ysiQVOnGXw94nZpAPA6sYapeFI+eh6FqUNzX
mk6vBbOmcZSccbNQYArHE504B4YCqOmoaSYYkKtMsE8jqzpPhNjfzp/haW+710LX
a0Tkx63ubUFfclpxCDezeWWkWaCUN/cALw3CknLa0Dhy2xSoRcRdKn23tNbE7qzN
E0S3ySvdQwAl+mG5aWpYIxG3pzOPVnVZ9c0p10a3CitlttNCbxWyuHv77+ldU9U0
WicCAwEAAaOB3DCB2TAdBgNVHQ4EFgQUrb2YejS0Jvf6xCZU7wO94CTLVBowCwYD
VR0PBAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wgZkGA1UdIwSBkTCBjoAUrb2YejS0
Jvf6xCZU7wO94CTLVBqhc6RxMG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRU
cnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsx
IjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENBIFJvb3SCAQEwDQYJKoZIhvcN
AQEFBQADggEBALCb4IUlwtYj4g+WBpKdQZic2YR5gdkeWxQHIzZlj7DYd7usQWxH
YINRsPkyPef89iYTx4AWpb9a/IfPeHmJIZriTAcKhjW88t5RxNKWt9x+Tu5w/Rw5
6wwCURQtjr0W4MHfRnXnJK3s9EK0hZNwEGe6nQY1ShjTK3rMUUKhemPR5ruhxSvC
Nr4TDea9Y355e6cJDUCrat2PisP29owaQgVR1EX1n6diIWgVIEM8med8vSTYqZEX
c4g/VhsxOBi0cQ+azcgOno4uG+GMmIPLHzHxREzGBHNJdmAPx/i9F4BrLunMTA5a
mnkPIAou1Z5jJh5VkpTYghdae9C8x49OhgQ=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIE/DCCA+SgAwIBAgIQFpDDKbZ4BgdRHwWwNEhGyzANBgkqhkiG9w0BAQUFADBv
MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
eHRlcm5hbCBDQSBSb290MB4XDTEwMDQxNjAwMDAwMFoXDTIwMDUzMDEwNDgzOFow
gYkxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO
BgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMS8wLQYD
VQQDEyZDT01PRE8gSGlnaC1Bc3N1cmFuY2UgU2VjdXJlIFNlcnZlciBDQTCCASIw
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOeH2sB35Ls6+mokyIBBrNIWExU9
+vf4KnbcqC05CM5ISr4PffDeurtH1b0t1xurDyCBIwhyscARlQ3m6qmH/8duHk9m
MrpTvAWqHCwM7003R2sQDNvFoJh+WNs31q7pBr3XqGXzN7nHbc53xybg13QfppgW
uwxryL530O9YpymgubhpBTbLstpYowt1rT2LIoIgPnCGmRy5T893pAcaI2PROFaE
7L+PxU70GJabGuiT7I2vFZwk8Fo76A+5qFoB07IcYMmcUgTdkqf+DKziRY0DYbx5
4Hcuh0E8WF/L9cV38ljITSjQmvrzcwkkaHS8IEzYLLCq6NlObfKMJNOTXZECAwEA
AaOCAXcwggFzMB8GA1UdIwQYMBaAFK29mHo0tCb3+sQmVO8DveAky1QaMB0GA1Ud
DgQWBBQ/1bXQ1kR5UEoXo5uMSty4sCJkazAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0T
AQH/BAgwBgEB/wIBADARBgNVHSAECjAIMAYGBFUdIAAwRAYDVR0fBD0wOzA5oDeg
NYYzaHR0cDovL2NybC51c2VydHJ1c3QuY29tL0FkZFRydXN0RXh0ZXJuYWxDQVJv
b3QuY3JsMIGzBggrBgEFBQcBAQSBpjCBozA/BggrBgEFBQcwAoYzaHR0cDovL2Ny
dC51c2VydHJ1c3QuY29tL0FkZFRydXN0RXh0ZXJuYWxDQVJvb3QucDdjMDkGCCsG
AQUFBzAChi1odHRwOi8vY3J0LnVzZXJ0cnVzdC5jb20vQWRkVHJ1c3RVVE5TR0ND
QS5jcnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJ
KoZIhvcNAQEFBQADggEBABOFH1KAGMlT9/4uGq/M2Qs8wtOFgRDwKI25QH4sno/W
NoYKTBQt1pdDkkEZN0uWnuupMHkSlbMCNlftK7kdmBqjGAo/mzmLzaFJKUwv+dCV
jMhNlbqoQ88zqiUqWg6qJ8lOa7Hmcx+zdATD80ziqOtnt124CAUaVppUKYX1KU6A
O5XQe1OWEVbBAtPqsn/Kj5xwShSNWrkWYHXWzSceFs1bM455QM8oSOfccRZOdJF1
uSqM8XCsJt0EuUDChd4ck0DQzG7Dm6rvYGXfYCLwWqV6oi/kcHPuPNQmK2gHwSB6
6JhaPnufAotiwIWBgGA1fqUdDNKc32JFDdv8N/v1JSI=
-----END CERTIFICATE-----
StartCom Ltd.
=============
-----BEGIN CERTIFICATE-----
MIIFFjCCBH+gAwIBAgIBADANBgkqhkiG9w0BAQQFADCBsDELMAkGA1UEBhMCSUwxDzANBgNVBAgT
BklzcmFlbDEOMAwGA1UEBxMFRWlsYXQxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xGjAYBgNVBAsT
EUNBIEF1dGhvcml0eSBEZXAuMSkwJwYDVQQDEyBGcmVlIFNTTCBDZXJ0aWZpY2F0aW9uIEF1dGhv
cml0eTEhMB8GCSqGSIb3DQEJARYSYWRtaW5Ac3RhcnRjb20ub3JnMB4XDTA1MDMxNzE3Mzc0OFoX
DTM1MDMxMDE3Mzc0OFowgbAxCzAJBgNVBAYTAklMMQ8wDQYDVQQIEwZJc3JhZWwxDjAMBgNVBAcT
BUVpbGF0MRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMRowGAYDVQQLExFDQSBBdXRob3JpdHkgRGVw
LjEpMCcGA1UEAxMgRnJlZSBTU0wgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxITAfBgkqhkiG9w0B
CQEWEmFkbWluQHN0YXJ0Y29tLm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA7YRgACOe
yEpRKSfeOqE5tWmrCbIvNP1h3D3TsM+x18LEwrHkllbEvqoUDufMOlDIOmKdw6OsWXuO7lUaHEe+
o5c5s7XvIywI6Nivcy+5yYPo7QAPyHWlLzRMGOh2iCNJitu27Wjaw7ViKUylS7eYtAkUEKD4/mJ2
IhULpNYILzUCAwEAAaOCAjwwggI4MA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgHmMB0GA1Ud
DgQWBBQcicOWzL3+MtUNjIExtpidjShkjTCB3QYDVR0jBIHVMIHSgBQcicOWzL3+MtUNjIExtpid
jShkjaGBtqSBszCBsDELMAkGA1UEBhMCSUwxDzANBgNVBAgTBklzcmFlbDEOMAwGA1UEBxMFRWls
YXQxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xGjAYBgNVBAsTEUNBIEF1dGhvcml0eSBEZXAuMSkw
JwYDVQQDEyBGcmVlIFNTTCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYS
YWRtaW5Ac3RhcnRjb20ub3JnggEAMB0GA1UdEQQWMBSBEmFkbWluQHN0YXJ0Y29tLm9yZzAdBgNV
HRIEFjAUgRJhZG1pbkBzdGFydGNvbS5vcmcwEQYJYIZIAYb4QgEBBAQDAgAHMC8GCWCGSAGG+EIB
DQQiFiBGcmVlIFNTTCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAyBglghkgBhvhCAQQEJRYjaHR0
cDovL2NlcnQuc3RhcnRjb20ub3JnL2NhLWNybC5jcmwwKAYJYIZIAYb4QgECBBsWGWh0dHA6Ly9j
ZXJ0LnN0YXJ0Y29tLm9yZy8wOQYJYIZIAYb4QgEIBCwWKmh0dHA6Ly9jZXJ0LnN0YXJ0Y29tLm9y
Zy9pbmRleC5waHA/YXBwPTExMTANBgkqhkiG9w0BAQQFAAOBgQBscSXhnjSRIe/bbL0BCFaPiNhB
OlP1ct8nV0t2hPdopP7rPwl+KLhX6h/BquL/lp9JmeaylXOWxkjHXo0Hclb4g4+fd68p00UOpO6w
NnQt8M2YI3s3S9r+UZjEHjQ8iP2ZO1CnwYszx8JSFhKVU2Ui77qLzmLbcCOxgN8aIDjnfg==
-----END CERTIFICATE-----
StartCom Certification Authority
================================
-----BEGIN CERTIFICATE-----
MIIHyTCCBbGgAwIBAgIBATANBgkqhkiG9w0BAQUFADB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMN
U3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmlu
ZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0
NjM2WhcNMzYwOTE3MTk0NjM2WjB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk
LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMg
U3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
ggIKAoICAQDBiNsJvGxGfHiflXu1M5DycmLWwTYgIiRezul38kMKogZkpMyONvg45iPwbm2xPN1y
o4UcodM9tDMr0y+v/uqwQVlntsQGfQqedIXWeUyAN3rfOQVSWff0G0ZDpNKFhdLDcfN1YjS6LIp/
Ho/u7TTQEceWzVI9ujPW3U3eCztKS5/CJi/6tRYccjV3yjxd5srhJosaNnZcAdt0FCX+7bWgiA/d
eMotHweXMAEtcnn6RtYTKqi5pquDSR3l8u/d5AGOGAqPY1MWhWKpDhk6zLVmpsJrdAfkK+F2PrRt
2PZE4XNiHzvEvqBTViVsUQn3qqvKv3b9bZvzndu/PWa8DFaqr5hIlTpL36dYUNk4dalb6kMMAv+Z
6+hsTXBbKWWc3apdzK8BMewM69KN6Oqce+Zu9ydmDBpI125C4z/eIT574Q1w+2OqqGwaVLRcJXrJ
osmLFqa7LH4XXgVNWG4SHQHuEhANxjJ/GP/89PrNbpHoNkm+Gkhpi8KWTRoSsmkXwQqQ1vp5Iki/
untp+HDH+no32NgN0nZPV/+Qt+OR0t3vwmC3Zzrd/qqc8NSLf3Iizsafl7b4r4qgEKjZ+xjGtrVc
UjyJthkqcwEKDwOzEmDyei+B26Nu/yYwl/WL3YlXtq09s68rxbd2AvCl1iuahhQqcvbjM4xdCUsT
37uMdBNSSwIDAQABo4ICUjCCAk4wDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMCAa4wHQYDVR0OBBYE
FE4L7xqkQFulF2mHMMo0aEPQQa7yMGQGA1UdHwRdMFswLKAqoCiGJmh0dHA6Ly9jZXJ0LnN0YXJ0
Y29tLm9yZy9zZnNjYS1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0Y29tLm9yZy9zZnNj
YS1jcmwuY3JsMIIBXQYDVR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBATCCATswLwYIKwYBBQUH
AgEWI2h0dHA6Ly9jZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRw
Oi8vY2VydC5zdGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYg
U3RhcnQgQ29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5
LCByZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl
cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQuc3Rh
cnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMDgGCWCGSAGG+EIBDQQrFilT
dGFydENvbSBGcmVlIFNTTCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTANBgkqhkiG9w0BAQUFAAOC
AgEAFmyZ9GYMNPXQhV59CuzaEE44HF7fpiUFS5Eyweg78T3dRAlbB0mKKctmArexmvclmAk8jhvh
3TaHK0u7aNM5Zj2gJsfyOZEdUauCe37Vzlrk4gNXcGmXCPleWKYK34wGmkUWFjgKXlf2Ysd6AgXm
vB618p70qSmD+LIU424oh0TDkBreOKk8rENNZEXO3SipXPJzewT4F+irsfMuXGRuczE6Eri8sxHk
fY+BUZo7jYn0TZNmezwD7dOaHZrzZVD1oNB1ny+v8OqCQ5j4aZyJecRDjkZy42Q2Eq/3JR44iZB3
fsNrarnDy0RLrHiQi+fHLB5LEUTINFInzQpdn4XBidUaePKVEFMy3YCEZnXZtWgo+2EuvoSoOMCZ
EoalHmdkrQYuL6lwhceWD3yJZfWOQ1QOq92lgDmUYMA0yZZwLKMS9R9Ie70cfmu3nZD0Ijuu+Pwq
yvqCUqDvr0tVk+vBtfAii6w0TiYiBKGHLHVKt+V9E9e4DGTANtLJL4YSjCMJwRuCO3NJo2pXh5Tl
1njFmUNj403gdy3hZZlyaQQaRwnmDwFWJPsfvw55qVguucQJAX6Vum0ABj6y6koQOdjQK/W/7HW/
lwLFCRsI3FU34oH7N4RDYiDK51ZLZer+bMEkkyShNOsF/5oirpt9P/FlUQqmMGqz9IgcgA38coro
g14=
-----END CERTIFICATE-----
Letsencrypt X1, X3, X4
======================
-----BEGIN CERTIFICATE-----
MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu
ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY
MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc
h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+
0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U
A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW
T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH
B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC
B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv
KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn
OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn
jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw
qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI
rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq
hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ
3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK
NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5
ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur
TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC
jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc
oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow
SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT
GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF
q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8
SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0
Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA
a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj
/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T
AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG
CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv
bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k
c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw
VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC
ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz
MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu
Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF
AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo
uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/
wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu
X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG
PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6
KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc6bLEeMfizANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDEwMloXDTIxMDMxNzE2NDEwMlow
SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT
GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFg0MIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEA4SR0Qnu3kTHZc/84qtjORFy3OQrcRK4NvUW5lzdnr71QT1/T
EFRr90HajmPmbVvA6ECpjEH80QOJ/2JhCWDWBwV4mpC9GmQ+T9zPdy+Ja8tnr0FN
xY0AwGv+jYTctfKVMajo9pCgQ0qTdFyzPkNpS4kiR3RRPplkw80kAfmELyh3FyKn
3cNsCExmLzd0xW+TjrBGNxZh0VCYyLAPT1hTfKz22i2WYVCtQ9wKpk+etVK5nI7v
Tt9GszHcIPxpwqMgdT7sOBs2TmZm0t/1ZqSTL3umDpQ+YD1KSxxvurRNHDyRWG4v
TcTacNvtATl2wEnn6TW1FAaQweWS4hD9a7m0hQIDAQABo4IBfTCCAXkwEgYDVR0T
AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG
CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv
bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k
c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw
VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC
ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz
MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu
Y3JsMB0GA1UdDgQWBBTFsatOTLHNZDCTfsGEmQWr5gPiJTANBgkqhkiG9w0BAQsF
AAOCAQEANlaeSdstfAtqFN3jdRZJFjx9X+Ob3PIDlekPYQ1OQ1Uw43rE1FUj7hUw
g2MJKfs9b7M0WoQg7C20nJY/ajsg7pWhUG3J6rlkDTfVY9faeWi0qsPYXE6BpBDr
5BrW/Xv8yT8U2BiEAmNggWq8dmFl82fghmLzHBM8X8NZ3ZwA1fGePA53AP5IoD+0
ArpW8Ik1sSuQBjZ8oQLfN+G8OoY7MNRopyLyQQCNy4aWfE+xYnoVoa5+yr+aPiX0
7YQrY/cKawAn7QB4PyF5//IKSAVs7mAuB68wbMdE3FKfOHfJ24W4z/bIJTrTY8Y5
Sr4AUhtzf8oVDrHZYWRrP4joIcOu/Q==
-----END CERTIFICATE-----
"""
pagekite-0.5.9.3/pagekite/logging.py 0000755 0000000 0000000 00000006172 13232067545 017226 0 ustar root root 0000000 0000000 """
Logging.
"""
##############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
##############################################################################
import time
import sys
import compat, common
from compat import *
from common import *
syslog = compat.syslog
org_stdout = sys.stdout
DEBUG_IO = False
LOG = []
LOG_LINE = 0
LOG_LENGTH = 300
LOG_THRESHOLD = 256 * 1024
def LogValues(values, testtime=None):
global LOG, LOG_LINE, LOG_LAST_TIME
now = int(testtime or time.time())
words = [('ts', '%x' % now),
('t', '%s' % ts_to_iso(now)),
('ll', '%x' % LOG_LINE)]
words.extend([(kv[0], ('%s' % kv[1]).replace('\t', ' ')
.replace('\r', ' ')
.replace('\n', ' ')
.replace('; ', ', ')
.strip()) for kv in values])
wdict = dict(words)
LOG_LINE += 1
LOG.append(wdict)
while len(LOG) > LOG_LENGTH:
LOG[0:(LOG_LENGTH/10)] = []
return (words, wdict)
def LogSyslog(values, wdict=None, words=None):
if values:
words, wdict = LogValues(values)
if 'err' in wdict:
syslog.syslog(syslog.LOG_ERR, '; '.join(['='.join(x) for x in words]))
elif 'debug' in wdict:
syslog.syslog(syslog.LOG_DEBUG, '; '.join(['='.join(x) for x in words]))
else:
syslog.syslog(syslog.LOG_INFO, '; '.join(['='.join(x) for x in words]))
def LogToFile(values, wdict=None, words=None):
if values:
words, wdict = LogValues(values)
try:
global LogFile
LogFile.write('; '.join(['='.join(x) for x in words]))
LogFile.write('\n')
except (OSError, IOError):
# Avoid crashing if the disk fills up or something lame like that
pass
def LogToMemory(values, wdict=None, words=None):
if values:
LogValues(values)
def FlushLogMemory():
global LOG
for l in LOG:
Log(None, wdict=l, words=[(w, l[w]) for w in l])
def LogError(msg, parms=None):
emsg = [('err', msg)]
if parms: emsg.extend(parms)
Log(emsg)
if common.gYamon:
common.gYamon.vadd('errors', 1, wrap=1000000)
def LogDebug(msg, parms=None):
emsg = [('debug', msg)]
if parms: emsg.extend(parms)
Log(emsg)
def LogInfo(msg, parms=None):
emsg = [('info', msg)]
if parms: emsg.extend(parms)
Log(emsg)
def ResetLog():
global LogFile, Log, org_stdout
LogFile = org_stdout
Log = LogToMemory
ResetLog()
pagekite-0.5.9.3/pagekite/dropper.py 0000755 0000000 0000000 00000003175 13232067545 017253 0 ustar root root 0000000 0000000 """
This is a "dropper template". A dropper is a single-purpose PageKite
back-end connector which embeds its own configuration.
"""
##############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
##############################################################################
import sys
import pagekite.pk as pk
import pagekite.httpd as httpd
if __name__ == "__main__":
kn = '@KITENAME@'
ss = '@SECRET@'
if len(sys.argv) == 1:
sys.argv.extend([
'--daemonize',
'--runas=nobody',
'--logfile=/tmp/pagekite-%s.log' % kn,
])
sys.argv[1:1] = [
'--clean',
'--noloop',
'--nocrashreport',
'--defaults',
'--kitename=%s' % kn,
'--kitesecret=%s' % ss,
'--all'
]
sys.argv.extend('@ARGS@'.split())
pk.Main(pk.PageKite, pk.Configure,
http_handler=httpd.UiRequestHandler,
http_server=httpd.UiHttpServer)
pagekite-0.5.9.3/pagekite/android.py 0000755 0000000 0000000 00000014150 13232067545 017213 0 ustar root root 0000000 0000000 """
This is the main function for the Android version of PageKite.
"""
#############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
#############################################################################
import sys
import pagekite.pk as pk
import pagekite.httpd as httpd
def Configure(pkobj):
pkobj.rcfile = "/sdcard/pagekite.cfg"
pkobj.enable_sslzlib = True
pk.Configure(pkobj)
if __name__ == "__main__":
if sys.stdout.isatty():
import pagekite.ui.basic
uiclass = pagekite.ui.basic.BasicUi
else:
uiclass = pk.NullUi
pk.Main(pk.PageKite, Configure,
uiclass=uiclass,
http_handler=httpd.UiRequestHandler,
http_server=httpd.UiHttpServer)
##############################################################################
CERTS="""\
StartCom Ltd.
=============
-----BEGIN CERTIFICATE-----
MIIFFjCCBH+gAwIBAgIBADANBgkqhkiG9w0BAQQFADCBsDELMAkGA1UEBhMCSUwxDzANBgNVBAgT
BklzcmFlbDEOMAwGA1UEBxMFRWlsYXQxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xGjAYBgNVBAsT
EUNBIEF1dGhvcml0eSBEZXAuMSkwJwYDVQQDEyBGcmVlIFNTTCBDZXJ0aWZpY2F0aW9uIEF1dGhv
cml0eTEhMB8GCSqGSIb3DQEJARYSYWRtaW5Ac3RhcnRjb20ub3JnMB4XDTA1MDMxNzE3Mzc0OFoX
DTM1MDMxMDE3Mzc0OFowgbAxCzAJBgNVBAYTAklMMQ8wDQYDVQQIEwZJc3JhZWwxDjAMBgNVBAcT
BUVpbGF0MRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMRowGAYDVQQLExFDQSBBdXRob3JpdHkgRGVw
LjEpMCcGA1UEAxMgRnJlZSBTU0wgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxITAfBgkqhkiG9w0B
CQEWEmFkbWluQHN0YXJ0Y29tLm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA7YRgACOe
yEpRKSfeOqE5tWmrCbIvNP1h3D3TsM+x18LEwrHkllbEvqoUDufMOlDIOmKdw6OsWXuO7lUaHEe+
o5c5s7XvIywI6Nivcy+5yYPo7QAPyHWlLzRMGOh2iCNJitu27Wjaw7ViKUylS7eYtAkUEKD4/mJ2
IhULpNYILzUCAwEAAaOCAjwwggI4MA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgHmMB0GA1Ud
DgQWBBQcicOWzL3+MtUNjIExtpidjShkjTCB3QYDVR0jBIHVMIHSgBQcicOWzL3+MtUNjIExtpid
jShkjaGBtqSBszCBsDELMAkGA1UEBhMCSUwxDzANBgNVBAgTBklzcmFlbDEOMAwGA1UEBxMFRWls
YXQxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xGjAYBgNVBAsTEUNBIEF1dGhvcml0eSBEZXAuMSkw
JwYDVQQDEyBGcmVlIFNTTCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYS
YWRtaW5Ac3RhcnRjb20ub3JnggEAMB0GA1UdEQQWMBSBEmFkbWluQHN0YXJ0Y29tLm9yZzAdBgNV
HRIEFjAUgRJhZG1pbkBzdGFydGNvbS5vcmcwEQYJYIZIAYb4QgEBBAQDAgAHMC8GCWCGSAGG+EIB
DQQiFiBGcmVlIFNTTCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAyBglghkgBhvhCAQQEJRYjaHR0
cDovL2NlcnQuc3RhcnRjb20ub3JnL2NhLWNybC5jcmwwKAYJYIZIAYb4QgECBBsWGWh0dHA6Ly9j
ZXJ0LnN0YXJ0Y29tLm9yZy8wOQYJYIZIAYb4QgEIBCwWKmh0dHA6Ly9jZXJ0LnN0YXJ0Y29tLm9y
Zy9pbmRleC5waHA/YXBwPTExMTANBgkqhkiG9w0BAQQFAAOBgQBscSXhnjSRIe/bbL0BCFaPiNhB
OlP1ct8nV0t2hPdopP7rPwl+KLhX6h/BquL/lp9JmeaylXOWxkjHXo0Hclb4g4+fd68p00UOpO6w
NnQt8M2YI3s3S9r+UZjEHjQ8iP2ZO1CnwYszx8JSFhKVU2Ui77qLzmLbcCOxgN8aIDjnfg==
-----END CERTIFICATE-----
StartCom Certification Authority
================================
-----BEGIN CERTIFICATE-----
MIIHyTCCBbGgAwIBAgIBATANBgkqhkiG9w0BAQUFADB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMN
U3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmlu
ZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDYwOTE3MTk0
NjM2WhcNMzYwOTE3MTk0NjM2WjB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk
LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMg
U3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
ggIKAoICAQDBiNsJvGxGfHiflXu1M5DycmLWwTYgIiRezul38kMKogZkpMyONvg45iPwbm2xPN1y
o4UcodM9tDMr0y+v/uqwQVlntsQGfQqedIXWeUyAN3rfOQVSWff0G0ZDpNKFhdLDcfN1YjS6LIp/
Ho/u7TTQEceWzVI9ujPW3U3eCztKS5/CJi/6tRYccjV3yjxd5srhJosaNnZcAdt0FCX+7bWgiA/d
eMotHweXMAEtcnn6RtYTKqi5pquDSR3l8u/d5AGOGAqPY1MWhWKpDhk6zLVmpsJrdAfkK+F2PrRt
2PZE4XNiHzvEvqBTViVsUQn3qqvKv3b9bZvzndu/PWa8DFaqr5hIlTpL36dYUNk4dalb6kMMAv+Z
6+hsTXBbKWWc3apdzK8BMewM69KN6Oqce+Zu9ydmDBpI125C4z/eIT574Q1w+2OqqGwaVLRcJXrJ
osmLFqa7LH4XXgVNWG4SHQHuEhANxjJ/GP/89PrNbpHoNkm+Gkhpi8KWTRoSsmkXwQqQ1vp5Iki/
untp+HDH+no32NgN0nZPV/+Qt+OR0t3vwmC3Zzrd/qqc8NSLf3Iizsafl7b4r4qgEKjZ+xjGtrVc
UjyJthkqcwEKDwOzEmDyei+B26Nu/yYwl/WL3YlXtq09s68rxbd2AvCl1iuahhQqcvbjM4xdCUsT
37uMdBNSSwIDAQABo4ICUjCCAk4wDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMCAa4wHQYDVR0OBBYE
FE4L7xqkQFulF2mHMMo0aEPQQa7yMGQGA1UdHwRdMFswLKAqoCiGJmh0dHA6Ly9jZXJ0LnN0YXJ0
Y29tLm9yZy9zZnNjYS1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0Y29tLm9yZy9zZnNj
YS1jcmwuY3JsMIIBXQYDVR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBATCCATswLwYIKwYBBQUH
AgEWI2h0dHA6Ly9jZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRw
Oi8vY2VydC5zdGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYg
U3RhcnQgQ29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5
LCByZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl
cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQuc3Rh
cnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMDgGCWCGSAGG+EIBDQQrFilT
dGFydENvbSBGcmVlIFNTTCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTANBgkqhkiG9w0BAQUFAAOC
AgEAFmyZ9GYMNPXQhV59CuzaEE44HF7fpiUFS5Eyweg78T3dRAlbB0mKKctmArexmvclmAk8jhvh
3TaHK0u7aNM5Zj2gJsfyOZEdUauCe37Vzlrk4gNXcGmXCPleWKYK34wGmkUWFjgKXlf2Ysd6AgXm
vB618p70qSmD+LIU424oh0TDkBreOKk8rENNZEXO3SipXPJzewT4F+irsfMuXGRuczE6Eri8sxHk
fY+BUZo7jYn0TZNmezwD7dOaHZrzZVD1oNB1ny+v8OqCQ5j4aZyJecRDjkZy42Q2Eq/3JR44iZB3
fsNrarnDy0RLrHiQi+fHLB5LEUTINFInzQpdn4XBidUaePKVEFMy3YCEZnXZtWgo+2EuvoSoOMCZ
EoalHmdkrQYuL6lwhceWD3yJZfWOQ1QOq92lgDmUYMA0yZZwLKMS9R9Ie70cfmu3nZD0Ijuu+Pwq
yvqCUqDvr0tVk+vBtfAii6w0TiYiBKGHLHVKt+V9E9e4DGTANtLJL4YSjCMJwRuCO3NJo2pXh5Tl
1njFmUNj403gdy3hZZlyaQQaRwnmDwFWJPsfvw55qVguucQJAX6Vum0ABj6y6koQOdjQK/W/7HW/
lwLFCRsI3FU34oH7N4RDYiDK51ZLZer+bMEkkyShNOsF/5oirpt9P/FlUQqmMGqz9IgcgA38coro
g14=
-----END CERTIFICATE-----
"""
pagekite-0.5.9.3/pagekite/manual.py 0000755 0000000 0000000 00000054256 13232067545 017063 0 ustar root root 0000000 0000000 #!/usr/bin/env python
"""
The program manual!
"""
import re
import time
import os
from common import *
from compat import ts_to_iso
MAN_NAME = ("""\
pagekite.py v%s - Make localhost servers publicly visible
""" % APPVER)
MAN_SYNOPSIS = ("""\
pagekite.py [--options] [service] kite-name [+flags]
""")
MAN_DESCRIPTION = ("""\
PageKite is a system for exposing localhost servers to the
public Internet. It is most commonly used to make local web servers or
SSH servers publicly visible, although almost any TCP-based protocol can
work if the client knows how to use an HTTP proxy.
PageKite uses a combination of tunnels and reverse proxies to compensate
for the fact that localhost usually does not have a public IP
address and is often subject to adverse network conditions, including
aggressive firewalls and multiple layers of NAT.
This program implements both ends of the tunnel: the local "back-end"
and the remote "front-end" reverse-proxy relay. For convenience,
pagekite.py also includes a basic HTTP server for quickly exposing
files and directories to the World Wide Web for casual sharing and
collaboration.
""")
MAN_EXAMPLES = ("""\
Basic usage, gives http://localhost:80/ a public name:
$ pagekite.py NAME.pagekite.me
To expose specific folders, files or use alternate local ports:
$ pagekite.py /a/path/ NAME.pagekite.me +indexes # built-in HTTPD
$ pagekite.py *.html NAME.pagekite.me # built-in HTTPD
$ pagekite.py 3000 NAME.pagekite.me # HTTPD on 3000
To expose multiple local servers (SSH and HTTP):
$ pagekite.py ssh://NAME.pagekite.me AND 3000 NAME.pagekite.me
""")
MAN_KITES = ("""\
The most comman usage of pagekite.py is as a back-end, where it
is used to expose local services to the outside world.
Examples of services are: a local HTTP server, a local SSH server,
a folder or a file.
A service is exposed by describing it on the command line, along with the
desired public kite name. If a kite name is requested which does not already
exist in the configuration file and program is run interactively, the user
will be prompted and given the option of signing up and/or creating a new
kite using the pagekite.net service.
Multiple services and kites can be specified on a single command-line,
separated by the word 'AND' (note capital letters are required).
This may cause problems if you have many files and folders by that
name, but that should be relatively rare. :-)
""")
MAN_KITE_EXAMPLES = ("""\
The options --list, --add, --disable and \
--remove can be used to
manipulate the kites and service definitions in your configuration file,
if you prefer not to edit it by hand. Examples:
Adding new kites
$ pagekite.py --add /a/path/ NAME.pagekite.me +indexes
$ pagekite.py --add 80 OTHER-NAME.pagekite.me
To display the current configuration
$ pagekite.py --list
Disable or delete kites (--add re-enables)
$ pagekite.py --disable OTHER-NAME.pagekite.me
$ pagekite.py --remove NAME.pagekite.me
""")
MAN_FLAGS = ("""\
Flags are used to tune the behavior of a particular kite, for example
by enabling access controls or specific features of the built-in HTTP
server.
""")
MAN_FLAGS_COMMON = ("""\
+ip/1.2.3.4 __Enable connections only from this IP address.
+ip/1.2.3 __Enable connections only from this /24 netblock.
""")
MAN_FLAGS_HTTP = ("""\
+password/name=pass
Require a username and password (HTTP Basic Authentication)
+rewritehost __Rewrite the incoming Host: header.
+rewritehost=N __Replace Host: header value with N.
+rawheaders __Do not rewrite (or add) any HTTP headers at all.
+insecure __Allow access to phpMyAdmin, /admin, etc. (per kite).
""")
MAN_FLAGS_BUILTIN = ("""\
+indexes __Enable directory indexes.
+indexes=all __Enable directory indexes including hidden (dot-) files.
+hide __Obfuscate URLs of shared files.
+cgi=list
A list of extensions, for which files should be treated as
CGI scripts (example: +cgi=cgi,pl,sh).
""")
MAN_OPTIONS = ("""\
The full power of pagekite.py lies in the numerous options which
can be specified on the command line or in a configuration file (see below).
Note that many options, especially the service and domain definitions,
are additive and if given multiple options the program will attempt to
obey them all. Options are processed in order and if they are not
additive then the last option will override all preceding ones.
Although pagekite.py accepts a great many options, most of the
time the program defaults will Just Work.
""")
MAN_OPT_COMMON = ("""\
--clean __Skip loading the default configuration file.
--signup __Interactively sign up for pagekite.net service.
--defaults __Set defaults for use with pagekite.net service.
--whitelabel=D __Set defaults for pagekite.net white-labels.
--whitelabels=D __Set defaults for pagekite.net white-labels (with TLS).
--nocrashreport __Don't send anonymous crash reports to pagekite.net.
""")
MAN_OPT_BACKEND = ("""\
--shell __Run PageKite in an interactive shell.
--nullui __Silent UI for scripting. Assumes Yes on all questions.
--list __List all configured kites.
--add __Add (or enable) the following kites, save config.
--remove __Remove the following kites, save config.
--disable __Disable the following kites, save config.
--only __Disable all but the following kites, save config.
--insecure __Allow access to phpMyAdmin, /admin, etc. (global).
--local=ports __Configure for local serving only (no remote front-end).
--watch=N __Display proxied data (higher N = more verbosity).
--noproxy __Ignore system (or config file) proxy settings.
--proxy=type:server:port,\
--socksify=server:port,\
--torify=server:port __
Connect to the front-ends using SSL, an HTTP proxy, a SOCKS proxy,
or the Tor anonymity network. The type can be any of 'ssl', 'http'
or 'socks5'. The server name can either be a plain hostname,
user@hostname or user:password@hostname. For SSL connections the
user part may be a path to a client cert PEM file. If multiple
proxies are defined, they will be chained one after another.
--service_on=proto:kitename:host:port:secret __
Explicit configuration for a service kite. Generally kites are
created on the command-line using the service short-hand
described above, but this syntax is used in the config file.
--service_off=proto:kitename:host:port:secret __
Same as --service_on, except disabled by default.
--service_cfg=..., --webpath=... __
These options are used in the configuration file to store service
and flag settings (see above). These are both likely to change in
the near future, so please just pretend you didn't notice them.
--frontend=host:port __
Connect to the named front-end server. If this option is repeated,
multiple connections will be made.
--frontends=num:dns-name:port __
Choose num front-ends from the A records of a DNS domain
name, using the given port number. Default behavior is to probe
all addresses and use the fastest one.
--nofrontend=ip:port __
Never connect to the named front-end server. This can be used to
exclude some front-ends from auto-configuration.
--fe_certname=domain __
Connect using SSL, accepting valid certs for this domain. If
this option is repeated, any of the named certificates will be
accepted, but the first will be preferred.
--fe_nocertcheck
Connect using SSL/TLS, but do not verify the remote certificate.
This is largely insecure but still thwarts passive attacks and
prevents routers and firewalls from corrupting the PageKite tunnel.
--ca_certs=/path/to/file __
Path to your trusted root SSL certificates file.
--dyndns=X __
Register changes with DynDNS provider X. X can either be simply
the name of one of the 'built-in' providers, or a URL format
string for ad-hoc updating.
--keepalive=N __
Force traffic over idle tunnels every N seconds, to cope with
firewalls that kill idle TCP connections. Backend only: if set
to "auto" (the default), the interval will be adjusted
automatically in response to disconnects.
--all __Terminate early if any tunnels fail to register.
--new __Don't attempt to connect to any kites' old front-ends.
--fingerpath=P __Path recipe for the httpfinger back-end proxy.
--noprobes __Reject all probes for service state.
""")
MAN_OPT_FRONTEND = ("""\
--isfrontend __Enable front-end operation.
--domain=proto,proto2,pN:domain:secret __
Accept tunneling requests for the named protocols and specified
domain, using the given secret. A * may be used as a wildcard for
subdomains or protocols.
--authdomain=auth-domain,\
--authdomain=target-domain:auth-domain __
Use auth-domain as a remote authentication server for the
DNS-based authetication protocol. If no target-domain
is given, use this as the default authentication method.
--motd=/path/to/motd __
Send the contents of this file to new back-ends as a
"message of the day".
--host=hostname __Listen on the given hostname only.
--ports=list __Listen on a comma-separated list of ports.
--portalias=A:B __Report port A as port B to backends (because firewalls).
--protos=list __Accept the listed protocols for tunneling.
--rawports=list __
Listen for raw connections these ports. The string '%s'
allows arbitrary ports in HTTP CONNECT.
--accept_acl_file=/path/to/file __
Consult an external access control file before accepting an
incoming connection. Quick'n'dirty for mitigating abuse. The
format is one rule per line: `rule policy comment` where a
rule is an IP or regexp and policy is 'allow' or 'deny'.
--client_acl=policy:regexp,\
--tunnel_acl=policy:regexp __
Add a client connection or tunnel access control rule.
Policies should be 'allow' or 'deny', the regular expression
should be written to match IPv4 or IPv6 addresses. If defined,
access rules are checkd in order and if none matches, incoming
connections will be rejected.
--tls_default=name __
Default name to use for SSL, if SNI (Server Name Indication)
is missing from incoming HTTPS connections.
--tls_endpoint=name:/path/to/file __
Terminate SSL/TLS for a name using key/cert from a file.
""")
MAN_OPT_SYSTEM = ("""\
--optfile=/path/to/file __
Read settings from file X. Default is ~/.pagekite.rc.
--optdir=/path/to/directory __
Read settings from /path/to/directory/*.rc, in
lexicographical order.
--savefile=/path/to/file __
Saved settings will be written to this file.
--save __Save the current configuration to the savefile.
--settings __
Dump the current settings to STDOUT, formatted as a configuration
file would be.
--nozchunks __Disable zlib tunnel compression.
--sslzlib __Enable zlib compression in OpenSSL.
--buffers=N __Buffer at most N kB of data before blocking.
--logfile=F __Log to file F, stdio means standard output.
--daemonize __Run as a daemon.
--runas=U:G __Set UID:GID after opening our listening sockets.
--pidfile=P __Write PID to the named file.
--errorurl=U __URL to redirect to when back-ends are not found.
--errorurl=D:U __Custom error URL for domain D.
--selfsign __
Configure the built-in HTTP daemon for HTTPS, first generating a
new self-signed certificate using openssl if necessary.
--httpd=X:P,\
--httppass=X,\
--pemfile=X __
Configure the built-in HTTP daemon. These options are likely to
change in the near future, please pretend you didn't see them.
""")
MAN_CONFIG_FILES = ("""\
If you are using pagekite.py as a command-line utility, it will
load its configuration from a file in your home directory. The file is
named .pagekite.rc on Unix systems (including Mac OS X), or
pagekite.cfg on Windows.
If you are using pagekite.py as a system-daemon which starts up
when your computer boots, it is generally configured to load settings
from /etc/pagekite.d/*.rc (in lexicographical order).
In both cases, the configuration files contain one or more of the same
options as are used on the command line, with the difference that at most
one option may be present on each line, and the parser is more tolerant of
white-space. The leading '--' may also be omitted for readability and
blank lines and lines beginning with '#' are treated as comments.
NOTE: When using -o, --optfile or --optdir on the command line,
it is advisable to use --clean to suppress the default configuration.
""")
MAN_SECURITY = ("""\
Please keep in mind, that whenever exposing a server to the public
Internet, it is important to think about security. Hacked webservers are
frequently abused as part of virus, spam or phishing campaigns and in
some cases security breaches can compromise the entire operating system.
Some advice:
* Switch PageKite off when not using it.
* Use the built-in access controls and SSL encryption.
* Leave the firewall enabled unless you have good reason not to.
* Make sure you use good passwords everywhere.
* Static content is very hard to hack!
* Always, always make frequent backups of any important work.
Note that as of version 0.5, pagekite.py includes a very basic
request firewall, which attempts to prevent access to phpMyAdmin and
other sensitive systems. If it gets in your way, the +insecure
flag or --insecure option can be used to turn it off.
For more, please visit:
""")
MAN_LICENSE = ("""\
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni R. Einarsson.
This program is free software: you can redistribute it and/or modify it
under the terms of the GNU Affero General Public License as published by
the Free Software Foundation, either version 3 of the License, or (at
your option) any later version.
This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public
License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
""")
MAN_BUGS = ("""\
Using pagekite.py as a front-end relay with the native Python SSL
module may result in poor performance. Please use the pyOpenSSL wrappers
instead.
""")
MAN_SEE_ALSO = ("""\
lapcat(1), ,
""")
MAN_CREDITS = ("""\
- Bjarni R. Einarsson
- The Beanstalks Project ehf.
- The Rannis Technology Development Fund
- Joar Wandborg
- Luc-Pierre Terral
""")
MANUAL_TOC = (
('SH', 'Name', MAN_NAME),
('SH', 'Synopsis', MAN_SYNOPSIS),
('SH', 'Description', MAN_DESCRIPTION),
('SH', 'Basic usage', MAN_EXAMPLES),
('SH', 'Services and kites', MAN_KITES),
('SH', 'Kite configuration', MAN_KITE_EXAMPLES),
('SH', 'Flags', MAN_FLAGS),
('SS', 'Common flags', MAN_FLAGS_COMMON),
('SS', 'HTTP protocol flags', MAN_FLAGS_HTTP),
('SS', 'Built-in HTTPD flags', MAN_FLAGS_BUILTIN),
('SH', 'Options', MAN_OPTIONS),
('SS', 'Common options', MAN_OPT_COMMON),
('SS', 'Back-end options', MAN_OPT_BACKEND),
('SS', 'Front-end options', MAN_OPT_FRONTEND),
('SS', 'System options', MAN_OPT_SYSTEM),
('SH', 'Configuration files', MAN_CONFIG_FILES),
('SH', 'Security', MAN_SECURITY),
('SH', 'Bugs', MAN_BUGS),
('SH', 'See Also', MAN_SEE_ALSO),
('SH', 'Credits', MAN_CREDITS),
('SH', 'Copyright and license', MAN_LICENSE),
)
HELP_SHELL = ("""\
Press ENTER to fly your kites, CTRL+C to quit or give some arguments to
accomplish a more specific task.
""")
HELP_KITES = ("""\
""")
HELP_TOC = (
('about', 'About PageKite', MAN_DESCRIPTION),
('basics', 'Basic usage examples', MAN_EXAMPLES),
('kites', 'Services and kites', MAN_KITES),
('config', 'Adding, disabling or removing kites', MAN_KITE_EXAMPLES),
('flags', 'Service flags', '\n'.join([MAN_FLAGS,
MAN_FLAGS_COMMON,
MAN_FLAGS_HTTP,
MAN_FLAGS_BUILTIN])),
('files', 'Where are the config files?', MAN_CONFIG_FILES),
('security', 'A few words about security.', MAN_SECURITY),
('credits', 'License and credits', '\n'.join([MAN_LICENSE,
'CREDITS:',
MAN_CREDITS])),
('manual', 'The complete manual. See also: http://pagekite.net/man/', None)
)
def HELP(args):
name = title = text = ''
if args:
what = args[0].strip().lower()
for name, title, text in HELP_TOC:
if name == what:
break
if name == 'manual':
text = DOC()
elif not text:
text = ''.join([
'Type `help TOPIC` to to read about one of these topics:\n\n',
''.join([' %-10.10s %s\n' % (n, t) for (n, t, x) in HELP_TOC]),
'\n',
HELP_SHELL
])
return unindent(clean_text(text))
def clean_text(text):
return re.sub('', '`',
re.sub('', '', text.replace(' __', ' ')))
def unindent(text):
return re.sub('(?m)^ ', '', text)
def MINIDOC():
return ("""\
>>> Welcome to pagekite.py v%s!
%s
To sign up with PageKite.net or get advanced instructions:
$ pagekite.py --signup
$ pagekite.py --help
If you request a kite which does not exist in your configuration file,
the program will offer to help you sign up with https://pagekite.net/
and create it. Pick a name, any name!\
""") % (APPVER, clean_text(MAN_EXAMPLES))
def DOC():
doc = ''
for h, section, text in MANUAL_TOC:
doc += '%s\n\n%s\n' % (h == 'SH' and section.upper() or ' '+section,
clean_text(text))
return doc
def MAN(pname=None):
lastchange = os.path.getmtime(sys.argv[0])
man = ("""\
.\\" This man page is autogenerated from the pagekite.py built-in manual.
.TH PAGEKITE "1" "%s" "https://pagekite.net/" "Awesome Commands"
.nh
.ad l
""") % ts_to_iso(lastchange).split('T')[0]
for h, section, text in MANUAL_TOC:
man += ('.%s %s\n\n%s\n\n'
) % (h, h == 'SH' and section.upper() or section,
re.sub('\n +', '\n', '\n'+text.strip())
.replace('\n--', '\n.TP\n\\fB--')
.replace('\n+', '\n.TP\n\\fB+')
.replace(' __', '\\fR\n')
.replace('-', '\\-')
.replace('
', '\n.nf\n').replace('
', '\n.fi\n')
.replace('', '\\fB').replace('', '\\fR')
.replace('', '\\fI').replace('', '\\fR')
.replace('', '\\fI').replace('', '\\fR')
.replace('', '\\fI').replace('', '\\fR')
.replace('\\fR\\fR\n', '\\fR'))
if pname:
man = man.replace('pagekite.py', pname)
return man
def MARKDOWN(pname=None):
mkd = ''
for h, section, text in MANUAL_TOC:
if h == 'SH':
h = '##'
else:
h = '###'
mkd += ('%s %s %s\n%s\n\n'
) % (h, section, h,
re.sub('(|`)', '\\1',
re.sub(' + ([A-Z0-9])', ' \n \\1',
re.sub('\n ', '\n ',
re.sub('\n ', '\n', '\n'+text.strip()))
.replace(' __', ' ')
.replace('\n--', '\n * --')
.replace('\n+', '\n * +')
.replace('', '`').replace('', '`')
.replace('', '`').replace('', '`'))))
if pname:
mkd = mkd.replace('pagekite.py', pname)
return mkd
if __name__ == '__main__':
import sys
if '--nopy' in sys.argv:
pname = 'pagekite'
else:
pname = None
if '--man' in sys.argv:
print MAN(pname)
elif '--markdown' in sys.argv:
print MARKDOWN(pname)
elif '--minidoc' in sys.argv:
print MINIDOC()
else:
print DOC()
pagekite-0.5.9.3/pagekite/yamond.py 0000755 0000000 0000000 00000013417 13232067545 017067 0 ustar root root 0000000 0000000 """
This is a class implementing a flexible metric-store and an HTTP
thread for browsing the numbers.
"""
##############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
##############################################################################
import getopt
import os
import random
import re
import select
import socket
import struct
import sys
import threading
import time
import traceback
import urllib
import BaseHTTPServer
try:
from urlparse import parse_qs, urlparse
except Exception, e:
from cgi import parse_qs
from urlparse import urlparse
class YamonRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
def do_yamon_vars(self):
self.send_response(200)
self.send_header('Content-Type', 'text/plain')
self.send_header('Cache-Control', 'no-cache')
self.end_headers()
self.wfile.write(self.server.yamond.render_vars_text())
def do_heapy(self):
from guppy import hpy
self.send_response(200)
self.send_header('Content-Type', 'text/plain')
self.send_header('Cache-Control', 'no-cache')
self.end_headers()
self.wfile.write(hpy().heap())
def do_404(self):
self.send_response(404)
self.send_header('Content-Type', 'text/html')
self.end_headers()
self.wfile.write('
')
def handle_path(self, path, query):
if path == '/vars.txt':
self.do_yamon_vars()
elif path == '/heap.txt':
self.do_heapy()
elif path == '/':
self.do_root()
else:
self.do_404()
def do_GET(self):
(scheme, netloc, path, params, query, frag) = urlparse(self.path)
qs = parse_qs(query)
return self.handle_path(path, query)
class YamonHttpServer(BaseHTTPServer.HTTPServer):
def __init__(self, yamond, handler):
BaseHTTPServer.HTTPServer.__init__(self, yamond.sspec, handler)
self.yamond = yamond
class YamonD(threading.Thread):
"""Handle HTTP in a separate thread."""
def __init__(self, sspec,
server=YamonHttpServer,
handler=YamonRequestHandler):
threading.Thread.__init__(self)
self.lock = threading.Lock()
self.server = server
self.handler = handler
self.sspec = sspec
self.httpd = None
self.running = False
self.values = {}
self.lists = {}
self.views = {}
def vmax(self, var, value):
try:
self.lock.acquire()
if value > self.values[var]:
self.values[var] = value
finally:
self.lock.release()
def vscale(self, var, ratio, add=0):
try:
self.lock.acquire()
if var not in self.values:
self.values[var] = 0
self.values[var] *= ratio
self.values[var] += add
finally:
self.lock.release()
def vset(self, var, value):
try:
self.lock.acquire()
self.values[var] = value
finally:
self.lock.release()
def vadd(self, var, value, wrap=None):
try:
self.lock.acquire()
if var not in self.values:
self.values[var] = 0
self.values[var] += value
if wrap is not None and self.values[var] >= wrap:
self.values[var] -= wrap
finally:
self.lock.release()
def vmin(self, var, value):
try:
self.lock.acquire()
if value < self.values[var]:
self.values[var] = value
finally:
self.lock.release()
def vdel(self, var):
try:
self.lock.acquire()
if var in self.values:
del self.values[var]
finally:
self.lock.release()
def lcreate(self, listn, elems):
try:
self.lock.acquire()
self.lists[listn] = [elems, 0, ['' for x in xrange(0, elems)]]
finally:
self.lock.release()
def ladd(self, listn, value):
try:
self.lock.acquire()
lst = self.lists[listn]
lst[2][lst[1]] = value
lst[1] += 1
lst[1] %= lst[0]
finally:
self.lock.release()
def render_vars_text(self, view=None):
if view:
if view == 'heapy':
from guppy import hpy
return hpy().heap()
else:
values, lists = self.views[view]
else:
values, lists = self.values, self.lists
data = []
for var in values:
data.append('%s: %s\n' % (var, values[var]))
for lname in lists:
(elems, offset, lst) = lists[lname]
l = lst[offset:]
l.extend(lst[:offset])
data.append('%s: %s\n' % (lname, ' '.join(['%s' % (x, ) for x in l])))
data.sort()
return ''.join(data)
def quit(self):
if self.httpd:
self.running = False
urllib.urlopen('http://%s:%s/exiting/' % self.sspec,
proxies={}).readlines()
def run(self):
self.httpd = self.server(self, self.handler)
self.sspec = self.httpd.server_address
self.running = True
while self.running: self.httpd.handle_request()
if __name__ == '__main__':
yd = YamonD(('', 0))
yd.vset('bjarni', 100)
yd.lcreate('foo', 2)
yd.ladd('foo', 1)
yd.ladd('foo', 2)
yd.ladd('foo', 3)
yd.run()
pagekite-0.5.9.3/pagekite/pk.py 0000755 0000000 0000000 00000404340 13232067545 016211 0 ustar root root 0000000 0000000 """
This is what is left of the original monolithic pagekite.py.
This is slowly being refactored into smaller sub-modules.
"""
##############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
##############################################################################
import base64
import cgi
from cgi import escape as escape_html
import errno
import getopt
import httplib
import os
import random
import re
import select
import socket
import struct
import sys
import tempfile
import threading
import time
import traceback
import urllib
import xmlrpclib
import zlib
import SocketServer
from CGIHTTPServer import CGIHTTPRequestHandler
from SimpleXMLRPCServer import SimpleXMLRPCServer, SimpleXMLRPCRequestHandler
import Cookie
from compat import *
from common import *
import compat
import common
import logging
OPT_FLAGS = 'o:O:S:H:P:X:L:ZI:fA:R:h:p:aD:U:NE:'
OPT_ARGS = ['noloop', 'clean', 'nopyopenssl', 'nossl', 'nocrashreport',
'nullui', 'remoteui', 'uiport=', 'help', 'settings',
'optfile=', 'optdir=', 'savefile=',
'friendly', 'shell',
'signup', 'list', 'add', 'only', 'disable', 'remove', 'save',
'service_xmlrpc=', 'controlpanel', 'controlpass',
'httpd=', 'pemfile=', 'httppass=', 'errorurl=', 'webpath=',
'logfile=', 'daemonize', 'nodaemonize', 'runas=', 'pidfile=',
'isfrontend', 'noisfrontend', 'settings',
'defaults', 'whitelabel=', 'whitelabels=', 'local=', 'domain=',
'auththreads=', 'authdomain=', 'motd=', 'register=', 'host=',
'noupgradeinfo', 'upgradeinfo=',
'ports=', 'protos=', 'portalias=', 'rawports=',
'tls_legacy', 'tls_default=', 'tls_endpoint=', 'selfsign',
'fe_certname=', 'fe_nocertcheck', 'ca_certs=',
'kitename=', 'kitesecret=', 'fingerpath=',
'backend=', 'define_backend=', 'be_config=', 'insecure',
'service_on=', 'service_off=', 'service_cfg=',
'tunnel_acl=', 'client_acl=', 'accept_acl_file=',
'frontend=', 'nofrontend=', 'frontends=', 'keepalive=',
'torify=', 'socksify=', 'proxy=', 'noproxy',
'new', 'all', 'noall', 'dyndns=', 'nozchunks', 'sslzlib',
'buffers=', 'noprobes', 'debugio', 'watch=', 'overload=',
# DEPRECATED:
'reloadfile=', 'autosave', 'noautosave', 'webroot=',
'webaccess=', 'webindexes=', 'delete_backend=']
# Enable system proxies
# This will all fail if we don't have PySocksipyChain available.
# FIXME: Move this code somewhere else?
socks.usesystemdefaults()
socks.wrapmodule(sys.modules[__name__])
if socks.HAVE_SSL:
# Secure connections to pagekite.net in SSL tunnels.
def_hop = socks.parseproxy('default')
https_hop = socks.parseproxy(('httpcs!%s!443'
) % ','.join(['pagekite.net']+SERVICE_CERTS))
for dest in ('pagekite.net', 'up.pagekite.net', 'up.b5p.us'):
socks.setproxy(dest, *def_hop)
socks.addproxy(dest, *socks.parseproxy('http!%s!443' % dest))
socks.addproxy(dest, *https_hop)
else:
# FIXME: Should scream and shout about lack of security.
pass
##[ PageKite.py code starts here! ]############################################
from proto.proto import *
from proto.parsers import *
from proto.selectables import *
from proto.filters import *
from proto.conns import *
from ui.nullui import NullUi
# FIXME: This could easily be a pool of threads to let us handle more
# than one incoming request at a time.
class AuthThread(threading.Thread):
"""Handle authentication work in a separate thread."""
#daemon = True
def __init__(self, conns):
threading.Thread.__init__(self)
self.qc = threading.Condition()
self.jobs = []
self.conns = conns
def check(self, requests, conn, callback):
self.qc.acquire()
self.jobs.append((requests, conn, callback))
self.qc.notify()
self.qc.release()
def quit(self):
self.qc.acquire()
self.keep_running = False
self.qc.notify()
self.qc.release()
try:
self.join()
except RuntimeError:
pass
def run(self):
self.keep_running = True
while self.keep_running:
try:
self._run()
except Exception, e:
logging.LogError('AuthThread died: %s' % e)
time.sleep(5)
logging.LogDebug('AuthThread: done')
def _run(self):
self.qc.acquire()
while self.keep_running:
now = int(time.time())
if not self.jobs:
(requests, conn, callback) = None, None, None
self.qc.wait()
else:
(requests, conn, callback) = self.jobs.pop(0)
if logging.DEBUG_IO: print '=== AUTH REQUESTS\n%s\n===' % requests
self.qc.release()
quotas = []
q_conns = []
q_days = []
results = []
log_info = []
session = '%x:%s:' % (now, globalSecret())
for request in requests:
try:
proto, domain, srand, token, sign, prefix = request
except:
logging.LogError('Invalid request: %s' % (request, ))
continue
what = '%s:%s:%s' % (proto, domain, srand)
session += what
if not token or not sign:
# Send a challenge. Our challenges are time-stamped, so we can
# put stict bounds on possible replay attacks (20 minutes atm).
results.append(('%s-SignThis' % prefix,
'%s:%s' % (what, signToken(payload=what,
timestamp=now))))
else:
# This is a bit lame, but we only check the token if the quota
# for this connection has never been verified.
(quota, days, conns, reason
) = self.conns.config.GetDomainQuota(proto, domain, srand, token,
sign, check_token=(conn.quota is None))
duplicates = self.conns.Tunnel(proto, domain)
if not quota:
if not reason: reason = 'quota'
results.append(('%s-Invalid' % prefix, what))
results.append(('%s-Invalid-Why' % prefix,
'%s;%s' % (what, reason)))
log_info.extend([('rejected', domain),
('quota', quota),
('reason', reason)])
elif duplicates:
# Duplicates... is the old one dead? Trigger a ping.
for conn in duplicates:
conn.TriggerPing()
results.append(('%s-Duplicate' % prefix, what))
log_info.extend([('rejected', domain),
('duplicate', 'yes')])
else:
results.append(('%s-OK' % prefix, what))
quotas.append((quota, request))
if conns: q_conns.append(conns)
if days: q_days.append(days)
if (proto.startswith('http') and
self.conns.config.GetTlsEndpointCtx(domain)):
results.append(('%s-SSL-OK' % prefix, what))
results.append(('%s-SessionID' % prefix,
'%x:%s' % (now, sha1hex(session))))
results.append(('%s-Misc' % prefix, urllib.urlencode({
'motd': (self.conns.config.motd_message or ''),
})))
for upgrade in self.conns.config.upgrade_info:
results.append(('%s-Upgrade' % prefix, ';'.join(upgrade)))
if quotas:
min_qconns = min(q_conns or [0])
if q_conns and min_qconns:
results.append(('%s-QConns' % prefix, min_qconns))
min_qdays = min(q_days or [0])
if q_days and min_qdays:
results.append(('%s-QDays' % prefix, min_qdays))
nz_quotas = [qp for qp in quotas if qp[0] and qp[0] > 0]
if nz_quotas:
quota = min(nz_quotas)[0]
conn.quota = [quota, [qp[1] for qp in nz_quotas], time.time()]
results.append(('%s-Quota' % prefix, quota))
elif requests:
if not conn.quota:
conn.quota = [None, requests, time.time()]
else:
conn.quota[2] = time.time()
if logging.DEBUG_IO: print '=== AUTH RESULTS\n%s\n===' % results
callback(results, log_info)
self.qc.acquire()
self.buffering = 0
self.qc.release()
##[ Selectables ]##############################################################
class Connections(object):
"""A container for connections (Selectables), config and tunnel info."""
def __init__(self, config):
self.config = config
self.ip_tracker = {}
self.idle = []
self.conns = []
self.conns_by_id = {}
self.tunnels = {}
self.auth_pool = []
def start(self, auth_threads=None, auth_thread_count=1):
self.auth_pool = auth_threads or []
while len(self.auth_pool) < auth_thread_count:
self.auth_pool.append(AuthThread(self))
for th in self.auth_pool:
th.start()
def Add(self, conn):
self.conns.append(conn)
def auth(self):
return self.auth_pool[random.randint(0, len(self.auth_pool)-1)]
def SetAltId(self, conn, new_id):
if conn.alt_id and conn.alt_id in self.conns_by_id:
del self.conns_by_id[conn.alt_id]
if new_id:
self.conns_by_id[new_id] = conn
conn.alt_id = new_id
def SetIdle(self, conn, seconds):
self.idle.append((time.time() + seconds, conn.last_activity, conn))
def TrackIP(self, ip, domain):
tick = '%d' % (time.time()/12)
if tick not in self.ip_tracker:
deadline = int(tick)-10
for ot in self.ip_tracker.keys():
if int(ot) < deadline:
del self.ip_tracker[ot]
self.ip_tracker[tick] = {}
if ip not in self.ip_tracker[tick]:
self.ip_tracker[tick][ip] = [1, domain]
else:
self.ip_tracker[tick][ip][0] += 1
self.ip_tracker[tick][ip][1] = domain
def LastIpDomain(self, ip):
domain = None
for tick in sorted(self.ip_tracker.keys()):
if ip in self.ip_tracker[tick]:
domain = self.ip_tracker[tick][ip][1]
return domain
def Remove(self, conn, retry=True):
try:
if conn.alt_id and conn.alt_id in self.conns_by_id:
del self.conns_by_id[conn.alt_id]
if conn in self.conns:
self.conns.remove(conn)
rmp = []
for elc in self.idle:
if elc[-1] == conn:
rmp.append(elc)
for elc in rmp:
self.idle.remove(elc)
for tid, tunnels in self.tunnels.items():
if conn in tunnels:
tunnels.remove(conn)
if not tunnels:
del self.tunnels[tid]
except (ValueError, KeyError):
# Let's not asplode if another thread races us for this.
logging.LogError('Failed to remove %s: %s' % (conn, format_exc()))
if retry:
return self.Remove(conn, retry=False)
def IdleConns(self):
return [p[-1] for p in self.idle]
def Sockets(self):
return [s.fd for s in self.conns]
def Readable(self):
# FIXME: This is O(n)
now = time.time()
return [s.fd for s in self.conns if s.IsReadable(now)]
def Blocked(self):
# FIXME: This is O(n)
# Magic side-effect: update buffered byte counter
blocked = [s for s in self.conns if s.IsBlocked()]
common.buffered_bytes[0] = sum([len(s.write_blocked) for s in blocked])
return [s.fd for s in blocked]
def DeadConns(self):
return [s for s in self.conns if s.IsDead()]
def CleanFds(self):
evil = []
for s in self.conns:
try:
i, o, e = select.select([s.fd], [s.fd], [s.fd], 0)
except:
evil.append(s)
for s in evil:
logging.LogDebug('Removing broken Selectable: %s' % s)
s.Cleanup()
self.Remove(s)
def Connection(self, fd):
for conn in self.conns:
if conn.fd == fd:
return conn
return None
def TunnelServers(self):
servers = {}
for tid in self.tunnels:
for tunnel in self.tunnels[tid]:
server = tunnel.server_info[tunnel.S_NAME]
if server is not None:
servers[server] = 1
return servers.keys()
def CloseTunnel(self, proto, domain, conn):
tid = '%s:%s' % (proto, domain)
if tid in self.tunnels:
if conn in self.tunnels[tid]:
self.tunnels[tid].remove(conn)
if not self.tunnels[tid]:
del self.tunnels[tid]
def CheckIdleConns(self, now):
active = []
for elc in self.idle:
expire, last_activity, conn = elc
if conn.last_activity > last_activity:
active.append(elc)
elif expire < now:
logging.LogDebug('Killing idle connection: %s' % conn)
conn.Die(discard_buffer=True)
elif conn.created < now - 1:
conn.SayHello()
for pair in active:
self.idle.remove(pair)
def Tunnel(self, proto, domain, conn=None):
tid = '%s:%s' % (proto, domain)
if conn is not None:
if tid not in self.tunnels:
self.tunnels[tid] = []
self.tunnels[tid].append(conn)
if tid in self.tunnels:
return self.tunnels[tid]
else:
try:
dparts = domain.split('.')[1:]
while len(dparts) > 1:
wild_tid = '%s:*.%s' % (proto, '.'.join(dparts))
if wild_tid in self.tunnels:
return self.tunnels[wild_tid]
dparts = dparts[1:]
except:
pass
return []
class HttpUiThread(threading.Thread):
"""Handle HTTP UI in a separate thread."""
daemon = True
def __init__(self, pkite, conns,
server=None, handler=None, ssl_pem_filename=None):
threading.Thread.__init__(self)
if not (server and handler):
self.serve = False
self.httpd = None
return
self.ui_sspec = pkite.ui_sspec
self.httpd = server(self.ui_sspec, pkite, conns,
handler=handler,
ssl_pem_filename=ssl_pem_filename)
self.httpd.socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
self.ui_sspec = pkite.ui_sspec = (self.ui_sspec[0],
self.httpd.socket.getsockname()[1])
self.serve = True
def quit(self):
self.serve = False
try:
knock = rawsocket(socket.AF_INET, socket.SOCK_STREAM)
knock.connect(self.ui_sspec)
knock.close()
except IOError:
pass
try:
self.join()
except RuntimeError:
try:
if self.httpd and self.httpd.socket:
self.httpd.socket.close()
except IOError:
pass
def run(self):
while self.serve:
try:
self.httpd.handle_request()
except KeyboardInterrupt:
self.serve = False
except Exception, e:
logging.LogInfo('HTTP UI caught exception: %s' % e)
if self.httpd: self.httpd.socket.close()
logging.LogDebug('HttpUiThread: done')
class UiCommunicator(threading.Thread):
"""Listen for interactive commands."""
def __init__(self, config, conns):
threading.Thread.__init__(self)
self.looping = False
self.config = config
self.conns = conns
logging.LogDebug('UiComm: Created')
def run(self):
self.looping = True
while self.looping:
if not self.config or not self.config.ui.ALLOWS_INPUT:
time.sleep(1)
continue
line = ''
try:
i, o, e = select.select([self.config.ui.rfile], [], [], 1)
if not i: continue
except:
pass
if self.config:
line = self.config.ui.rfile.readline().strip()
if line:
self.Parse(line)
logging.LogDebug('UiCommunicator: done')
def Reconnect(self):
if self.config.tunnel_manager:
self.config.ui.Status('reconfig')
self.config.tunnel_manager.CloseTunnels()
self.config.tunnel_manager.HurryUp()
def Parse(self, line):
try:
command, args = line.split(': ', 1)
logging.LogDebug('UiComm: %s(%s)' % (command, args))
if args.lower() == 'none': args = None
elif args.lower() == 'true': args = True
elif args.lower() == 'false': args = False
if command == 'exit':
self.config.keep_looping = False
self.config.main_loop = False
elif command == 'restart':
self.config.keep_looping = False
self.config.main_loop = True
elif command == 'config':
command = 'change settings'
self.config.Configure(['--%s' % args])
elif command == 'enablekite':
command = 'enable kite'
if args and args in self.config.backends:
self.config.backends[args][BE_STATUS] = BE_STATUS_UNKNOWN
self.Reconnect()
else:
raise Exception('No such kite: %s' % args)
elif command == 'disablekite':
command = 'disable kite'
if args and args in self.config.backends:
self.config.backends[args][BE_STATUS] = BE_STATUS_DISABLED
self.Reconnect()
else:
raise Exception('No such kite: %s' % args)
elif command == 'delkite':
command = 'remove kite'
if args and args in self.config.backends:
del self.config.backends[args]
self.Reconnect()
else:
raise Exception('No such kite: %s' % args)
elif command == 'addkite':
command = 'create new kite'
args = (args or '').strip().split() or ['']
if self.config.RegisterNewKite(kitename=args[0],
autoconfigure=True, ask_be=True):
self.Reconnect()
elif command == 'save':
command = 'save configuration'
self.config.SaveUserConfig(quiet=(args == 'quietly'))
except ValueError:
logging.LogDebug('UiComm: bogus: %s' % line)
except SystemExit:
self.config.keep_looping = False
self.config.main_loop = False
except:
logging.LogDebug('UiComm: failed %s' % (sys.exc_info(), ))
self.config.ui.Tell(['Oops!', '', 'Failed to %s, details:' % command,
'', '%s' % (sys.exc_info(), )], error=True)
def quit(self):
self.looping = False
self.conns = None
try:
self.join()
except RuntimeError:
pass
class TunnelManager(threading.Thread):
"""Create new tunnels as necessary or kill idle ones."""
daemon = True
def __init__(self, pkite, conns):
threading.Thread.__init__(self)
self.pkite = pkite
self.conns = conns
def CheckTunnelQuotas(self, now):
for tid in self.conns.tunnels:
for tunnel in self.conns.tunnels[tid]:
tunnel.RecheckQuota(self.conns, when=now)
def PingTunnels(self, now):
dead = {}
# If we keep getting disconnected, maybe we have a nasty firewall
# and should ping more frequently. Disabled at the frontend!
while (common.DISCONNECT_COUNT >= 2 and
not self.pkite.isfrontend and
not self.pkite.keepalive):
common.DISCONNECT_COUNT -= 2
common.PING_INTERVAL = max(common.PING_INTERVAL_MIN,
0.5 * common.PING_INTERVAL)
logging.LogDebug('TunnelManager: adjusted ping interval, PI=%s'
% common.PING_INTERVAL)
for tid in self.conns.tunnels:
for tunnel in self.conns.tunnels[tid]:
pings = int(self.pkite.keepalive or common.PING_INTERVAL)
if tunnel.server_info[tunnel.S_IS_MOBILE]:
pings = common.PING_INTERVAL_MOBILE
grace = max(PING_GRACE_DEFAULT,
len(tunnel.write_blocked)/(tunnel.write_speed or 0.001))
if tunnel.last_activity == 0:
pass
elif tunnel.last_ping < now - PING_GRACE_MIN:
if tunnel.last_activity < tunnel.last_ping-(PING_GRACE_MIN+grace):
dead['%s' % tunnel] = tunnel
elif tunnel.last_activity < now-pings:
tunnel.SendPing()
elif random.randint(0, 10*pings) == 0:
tunnel.SendPing()
for tunnel in dead.values():
logging.Log([('dead', tunnel.server_info[tunnel.S_NAME])])
tunnel.Die(discard_buffer=True)
def CloseTunnels(self):
close = []
for tid in self.conns.tunnels:
for tunnel in self.conns.tunnels[tid]:
close.append(tunnel)
for tunnel in close:
logging.Log([('closing', tunnel.server_info[tunnel.S_NAME])])
tunnel.Die(discard_buffer=True)
def quit(self):
self.keep_running = False
try:
self.join()
except RuntimeError:
pass
def run(self):
self.keep_running = True
self.explained = False
while self.keep_running:
try:
self._run()
except Exception, e:
logging.LogError('TunnelManager died: %s' % e)
if logging.DEBUG_IO:
traceback.print_exc(file=sys.stderr)
time.sleep(5)
logging.LogDebug('TunnelManager: done')
def DoFrontendWork(self):
self.CheckTunnelQuotas(time.time())
self.pkite.LoadMOTD()
# FIXME: Front-ends should close dead back-end tunnels.
for tid in self.conns.tunnels:
proto, domain = tid.split(':')
if '-' in proto:
proto, port = proto.split('-')
else:
port = ''
self.pkite.ui.NotifyFlyingFE(proto, port, domain)
def ListBackEnds(self):
self.pkite.ui.StartListingBackEnds()
for bid in self.pkite.backends:
be = self.pkite.backends[bid]
# Do we have auto-SSL at the front-end?
protoport, domain = bid.split(':', 1)
tunnels = self.conns.Tunnel(protoport, domain)
if be[BE_PROTO] in ('http', 'http2', 'http3') and tunnels:
has_ssl = True
for t in tunnels:
if (protoport, domain) not in t.remote_ssl:
has_ssl = False
else:
has_ssl = False
# Get list of webpaths...
domainp = '%s/%s' % (domain, be[BE_PORT] or '80')
if (self.pkite.ui_sspec and
be[BE_BHOST] == self.pkite.ui_sspec[0] and
be[BE_BPORT] == self.pkite.ui_sspec[1]):
builtin = True
dpaths = self.pkite.ui_paths.get(domainp, {})
else:
builtin = False
dpaths = {}
self.pkite.ui.NotifyBE(bid, be, has_ssl, dpaths,
is_builtin=builtin,
fingerprint=(builtin and self.pkite.ui_pemfingerprint))
self.pkite.ui.EndListingBackEnds()
def UpdateUiStatus(self, problem, connecting):
tunnel_count = len(self.pkite.conns and
self.pkite.conns.TunnelServers() or [])
tunnel_total = len(self.pkite.servers)
if tunnel_count == 0:
if self.pkite.isfrontend:
self.pkite.ui.Status('idle', message='Waiting for back-ends.')
elif tunnel_total == 0:
self.pkite.ui.Status('down', color=self.pkite.ui.GREY,
message='No kites ready to fly. Waiting...')
self.pkite.ui.Notify('It looks like your Internet connection might '
'be down! Will retry soon.',
color=self.pkite.ui.YELLOW)
self.pkite.ui.Notify(
' - Check whether you can ping pagekite.net or google.com')
if self.pkite.servers_auto:
hostname = self.pkite.servers_auto[1]
self.pkite.ui.Notify(
' - Check whether `%s` can be looked up in DNS' % hostname)
for hostport in self.pkite.servers_manual:
hostname = hostport.split(':')[0]
self.pkite.ui.Notify(
' - Check whether `%s` can be looked up in DNS' % hostname)
elif connecting == 0:
self.pkite.ui.Status('down', color=self.pkite.ui.RED,
message='Not connected to any front-end relays, will retry...')
elif tunnel_count < tunnel_total:
self.pkite.ui.Status('flying', color=self.pkite.ui.YELLOW,
message=('Only connected to %d/%d front-end relays, will retry...'
) % (tunnel_count, tunnel_total))
elif problem:
self.pkite.ui.Status('flying', color=self.pkite.ui.YELLOW,
message='DynDNS updates may be incomplete, will retry...')
else:
self.pkite.ui.Status('flying', color=self.pkite.ui.GREEN,
message='Kites are flying and all is well.')
def _run(self):
self.check_interval = 5
loop_count = 0
last_log = 0
while self.keep_running:
loop_count += 1
now = time.time()
if (now - last_log) >= (60 * 15):
# Report liveness/state roughly once every 15 minutes
logging.LogDebug('TunnelManager: loop #%d, interval=%s'
% (loop_count, self.check_interval))
last_log = now
# Reconnect if necessary, randomized exponential fallback.
problem, connecting = self.pkite.CreateTunnels(self.conns)
if problem or connecting:
logging.LogDebug(
'TunnelManager: problem=%s, connecting=%s, DC=%s, PI=%d'
% (problem, connecting,
common.DISCONNECT_COUNT,
(self.pkite.keepalive or common.PING_INTERVAL)))
incr = int(1+random.random()*self.check_interval)
self.check_interval = min(60, self.check_interval + incr)
time.sleep(1)
else:
self.check_interval = 5
# Make sure tunnels are really alive.
if self.pkite.isfrontend:
self.DoFrontendWork()
self.PingTunnels(time.time())
# FIXME: This is constant noise, instead there should be a
# command which requests this stuff.
self.ListBackEnds()
self.UpdateUiStatus(problem, connecting)
for i in xrange(0, self.check_interval):
if self.keep_running:
time.sleep(1)
if i > self.check_interval:
break
if self.pkite.isfrontend:
self.conns.CheckIdleConns(time.time())
def HurryUp(self):
self.check_interval = 0
def SecureCreate(path):
fd = open(path, 'w')
try:
os.chmod(path, 0600)
except OSError:
pass
return fd
def CreateSelfSignedCert(pem_path, ui):
ui.Notify('Creating a 2048-bit self-signed TLS certificate ...',
prefix='-', color=ui.YELLOW)
workdir = tempfile.mkdtemp()
def w(fn):
return os.path.join(workdir, fn)
os.system(('openssl genrsa -out %s 2048') % w('key'))
os.system(('openssl req -batch -new -key %s -out %s'
' -subj "/CN=PageKite/O=Self-Hosted/OU=Website"'
) % (w('key'), w('csr')))
os.system(('openssl x509 -req -days 3650 -in %s -signkey %s -out %s'
) % (w('csr'), w('key'), w('crt')))
pem = SecureCreate(pem_path)
pem.write(open(w('key')).read())
pem.write('\n')
pem.write(open(w('crt')).read())
pem.close()
for fn in ['key', 'csr', 'crt']:
os.remove(w(fn))
os.rmdir(workdir)
ui.Notify('Saved certificate to: %s' % pem_path,
prefix='-', color=ui.YELLOW)
class PageKite(object):
"""Configuration and master select loop."""
def __init__(self, ui=None, http_handler=None, http_server=None):
self.progname = ((sys.argv[0] or 'pagekite.py').split('/')[-1]
.split('\\')[-1])
self.pyfile = os.path.abspath(sys.argv[0])
self.ui = ui or NullUi()
self.ui_request_handler = http_handler
self.ui_http_server = http_server
self.ResetConfiguration()
def ResetConfiguration(self):
self.isfrontend = False
self.upgrade_info = []
self.auth_threads = 1
self.auth_domain = None
self.auth_domains = {}
self.motd = None
self.motd_message = None
self.server_host = ''
self.server_ports = [80]
self.server_raw_ports = []
self.server_portalias = {}
self.server_aliasport = {}
self.server_protos = ['http', 'http2', 'http3', 'https', 'websocket',
'irc', 'finger', 'httpfinger', 'raw', 'minecraft']
self.accept_acl_file = None
self.tunnel_acls = []
self.client_acls = []
self.tls_legacy = False
self.tls_default = None
self.tls_endpoints = {}
self.fe_certname = []
self.fe_nocertcheck = False
self.service_provider = SERVICE_PROVIDER
self.service_xmlrpc = SERVICE_XMLRPC
self.daemonize = False
self.pidfile = None
self.logfile = None
self.setuid = None
self.setgid = None
self.ui_httpd = None
self.ui_sspec_cfg = None
self.ui_sspec = None
self.ui_socket = None
self.ui_password = None
self.ui_pemfile = None
self.ui_pemfingerprint = None
self.ui_magic_file = '.pagekite.magic'
self.ui_paths = {}
self.insecure = False
self.be_config = {}
self.disable_zchunks = False
self.enable_sslzlib = False
self.buffer_max = DEFAULT_BUFFER_MAX
self.error_url = None
self.error_urls = {}
self.finger_path = '/~%s/.finger'
self.tunnel_manager = None
self.client_mode = 0
self.proxy_servers = []
self.no_proxy = False
self.require_all = False
self.no_probes = False
self.servers = []
self.servers_manual = []
self.servers_never = []
self.servers_auto = None
self.servers_new_only = False
self.servers_no_ping = False
self.servers_preferred = []
self.servers_sessionids = {}
self.keepalive = None
self.dns_cache = {}
self.ping_cache = {}
self.last_frontend_choice = 0
self.kitename = ''
self.kitesecret = ''
self.dyndns = None
self.last_updates = []
self.backends = {} # These are the backends we want tunnels for.
self.conns = None
self.last_loop = 0
self.keep_looping = True
self.main_loop = True
self.watch_level = [None]
self.overload = None
self.crash_report_url = '%scgi-bin/crashes.pl' % WWWHOME
self.rcfile_recursion = 0
self.rcfiles_loaded = []
self.savefile = None
self.added_kites = False
self.ui_wfile = sys.stderr
self.ui_rfile = sys.stdin
self.ui_port = None
self.ui_conn = None
self.ui_comm = None
self.save = 0
self.shell = False
self.kite_add = False
self.kite_only = False
self.kite_disable = False
self.kite_remove = False
# Searching for our configuration file! We prefer the documented
# 'standard' locations, but if nothing is found there and something local
# exists, use that instead.
try:
if sys.platform[:3] in ('win', 'os2'):
self.rcfile = os.path.join(os.path.expanduser('~'), 'pagekite.cfg')
self.devnull = 'nul'
else:
# Everything else
self.rcfile = os.path.join(os.path.expanduser('~'), '.pagekite.rc')
self.devnull = '/dev/null'
except Exception, e:
# The above stuff may fail in some cases, e.g. on Android in SL4A.
self.rcfile = 'pagekite.cfg'
self.devnull = '/dev/null'
self.ca_certs_default = self.ca_certs = None
self.SetDefaultCACerts()
def SetDefaultCACerts(self, **kwargs):
# Look for CA Certificates. If we don't find them in the host OS,
# we assume there might be something good in the program itself.
if self.ca_certs_default != self.pyfile:
self.ca_certs_default = self.FindCACerts(**kwargs)
self.ca_certs = self.ca_certs_default
def FindCACerts(self, use_curl_bundle=False):
# Search a bunch of paths, preferring the biggest/newest bundle found
biggest, newest, found = 0, 0, None
own_pemfile = "%s.pem" % '.'.join(self.rcfile.split('.')[:-1])
for path in list(OS_CA_CERTS) + [own_pemfile]:
if os.path.exists(path):
# We consider all bundles over 200k to be the same size...
size = min(200000, os.stat(path).st_size)
mtime = os.stat(path).st_mtime
if size > biggest:
# Choose the biggest bundle!
found, biggest, newest = path, size, mtime
elif size == biggest and mtime > newest:
# Choose the freshest bundle!
found, newest = path, mtime
if use_curl_bundle and ((not found) or
((found == own_pemfile) and (newest < time.time() - 365*24*3600))):
# No bundle found or bundle old, download a new one from the cURL site.
try:
urllib.URLopener().retrieve(CURL_CA_CERTS, filename=own_pemfile)
return self.FindCACerts(use_curl_bundle=False)
except:
pass
if found:
return found
return sys.argv[0] # Fall back to distributed CA certs
ACL_SHORTHAND = {
'localhost': '((::ffff:)?127\..*|::1)',
'any': '.*'
}
def CheckAcls(self, acls, address, which, conn=None):
if not acls:
return True
for policy, pattern in acls:
if re.match(self.ACL_SHORTHAND.get(pattern, pattern)+'$', address[0]):
if (policy.lower() == 'allow'):
return True
else:
if conn:
conn.LogError(('%s rejected by %s ACL: %s:%s'
) % (address[0], which, policy, pattern))
return False
if conn:
conn.LogError('%s rejected by default %s ACL' % (address[0], which))
return False
def CheckClientAcls(self, address, conn=None):
return self.CheckAcls(self.client_acls, address, 'client', conn)
def CheckTunnelAcls(self, address, conn=None):
return self.CheckAcls(self.tunnel_acls, address, 'tunnel', conn)
def SetLocalSettings(self, ports):
self.isfrontend = True
self.servers_auto = None
self.servers_manual = []
self.servers_never = []
self.server_ports = ports
self.backends = self.ArgToBackendSpecs('http:localhost:localhost:builtin:-')
def APPVER_DNS(self, tld):
appver_without_patchlevel = '.'.join(APPVER.split('.')[:3])
return ('fe4_%s.' + tld) % re.sub(r'[^\d]', '', appver_without_patchlevel)
def SetServiceDefaults(self, clobber=True, check=False):
def_dyndns = (DYNDNS['pagekite.net'], {'user': '', 'pass': ''})
def_frontends = (1, self.APPVER_DNS('b5p.us'), 443)
def_fe_certs = ['b5p.us'] + [c for c in SERVICE_CERTS if c != 'b5p.us']
def_ca_certs = self.pyfile
def_error_url = 'https://pagekite.net/offline/?'
if check:
return (self.dyndns == def_dyndns and
self.servers_auto == def_frontends and
self.error_url == def_error_url and
self.ca_certs == def_ca_certs and
(sorted(self.fe_certname) == sorted(def_fe_certs) or
not socks.HAVE_SSL))
else:
self.dyndns = (not clobber and self.dyndns) or def_dyndns
self.servers_auto = (not clobber and self.servers_auto) or def_frontends
self.error_url = (not clobber and self.error_url) or def_error_url
if socks.HAVE_SSL:
self.ca_certs_default = (not clobber and self.ca_certs_default) or def_ca_certs
self.ca_certs = (not clobber and self.ca_certs) or def_ca_certs
for cert in def_fe_certs:
if cert not in self.fe_certname:
self.fe_certname.append(cert)
return True
def SetWhitelabelDefaults(self, wld, secure=False, clobber=True, check=False):
def_dyndns = (DYNDNS[secure and 'whitelabels' or 'whitelabel'] % wld,
{'user': '', 'pass': ''})
def_frontends = (1, self.APPVER_DNS(wld), 443)
def_fe_certs = ['fe.%s' % wld, wld] + [c for c in SERVICE_CERTS if c != wld]
def_ca_certs = self.pyfile
def_error_url = 'http%s://www.%s/offline/?' % (secure and 's' or '', wld)
if check:
return (self.dyndns == def_dyndns and
self.servers_auto == def_frontends and
self.error_url == def_error_url and
self.ca_certs == def_ca_certs and
(sorted(self.fe_certname) == sorted(def_fe_certs) or
not socks.HAVE_SSL))
else:
self.dyndns = (not clobber and self.dyndns) or def_dyndns
self.servers_auto = (not clobber and self.servers_auto) or def_frontends
self.error_url = (not clobber and self.error_url) or def_error_url
if socks.HAVE_SSL:
self.ca_certs_default = (not clobber and self.ca_certs_default) or def_ca_certs
self.ca_certs = (not clobber and self.ca_certs) or def_ca_certs
for cert in def_fe_certs:
if cert not in self.fe_certname:
self.fe_certname.append(cert)
return True
def GenerateConfig(self, safe=False):
config = [
'###[ Current settings for pagekite.py v%s. ]#########' % APPVER,
'#',
'## NOTE: This file may be rewritten/reordered by pagekite.py.',
'#',
'',
]
if not self.kitename:
for be in self.backends.values():
if not self.kitename or len(self.kitename) < len(be[BE_DOMAIN]):
self.kitename = be[BE_DOMAIN]
self.kitesecret = be[BE_SECRET]
new = not (self.kitename or self.kitesecret or self.backends)
def p(vfmt, value, dval):
return '%s%s' % (value and value != dval
and ('', vfmt % value) or ('# ', vfmt % dval))
if self.kitename or self.kitesecret or new:
config.extend([
'##[ Default kite and account details ]##',
p('kitename = %s', self.kitename, 'NAME'),
p('kitesecret = %s', self.kitesecret, 'SECRET'),
''
])
kite_tld = None
if self.kitename:
kite_tld = '.'.join(self.kitename.split('.')[-2:])
def addManualFrontends():
if self.servers_manual or self.servers_never:
config.append('')
config.append('##[ Manual front-ends ]##')
for server in sorted(self.servers_manual):
config.append('frontend=%s' % server)
for server in sorted(self.servers_never):
config.append('nofrontend=%s' % server)
if self.SetServiceDefaults(check=True):
config.extend([
'##[ Front-end settings: use pagekite.net defaults ]##',
'defaults',
])
addManualFrontends()
elif (kite_tld and
self.SetWhitelabelDefaults(kite_tld, secure=False, check=True)):
config.extend([
'##[ Front-end settings: use %s defaults ]##' % kite_tld,
'whitelabel = %s' % kite_tld,
''
])
addManualFrontends()
elif (kite_tld and
self.SetWhitelabelDefaults(kite_tld, secure=True, check=True)):
config.extend([
'##[ Front-end settings: use %s defaults ]##' % kite_tld,
'whitelabels = %s' % kite_tld,
''
])
addManualFrontends()
else:
if not self.servers_auto and not self.servers_manual:
new = True
config.extend([
'##[ Use this to just use pagekite.net defaults ]##',
'# defaults',
''
])
config.append('##[ Custom front-end and dynamic DNS settings ]##')
if self.servers_auto:
config.append('frontends = %d:%s:%d' % self.servers_auto)
if self.servers_manual:
for server in sorted(self.servers_manual):
config.append('frontend = %s' % server)
if self.servers_never:
for server in sorted(self.servers_never):
config.append('nofrontend = %s' % server)
if not self.servers_auto and not self.servers_manual:
new = True
config.append('# frontends = N:hostname:port')
config.append('# frontend = hostname:port')
config.append('# nofrontend = hostname:port # never connect')
for server in self.fe_certname:
config.append('fe_certname = %s' % server)
if self.fe_nocertcheck:
config.append('fe_nocertcheck')
if self.dyndns:
provider, args = self.dyndns
for prov in sorted(DYNDNS.keys()):
if DYNDNS[prov] == provider and prov != 'beanstalks.net':
args['prov'] = prov
if 'prov' not in args:
args['prov'] = provider
if args['pass']:
config.append('dyndns = %(user)s:%(pass)s@%(prov)s' % args)
elif args['user']:
config.append('dyndns = %(user)s@%(prov)s' % args)
else:
config.append('dyndns = %(prov)s' % args)
else:
new = True
config.extend([
'# dyndns = pagekite.net OR',
'# dyndns = user:pass@dyndns.org OR',
'# dyndns = user:pass@no-ip.com' ,
'#',
p('errorurl = %s', self.error_url, 'http://host/page/'),
p('fingerpath = %s', self.finger_path, '/~%s/.finger'),
'',
])
if self.ca_certs != self.ca_certs_default:
config.append('ca_certs = %s' % self.ca_certs)
if self.keepalive != None:
config.append('keepalive = %d' % self.keepalive)
for dom in sorted(self.error_urls.keys()):
config.append('errorurl = %s:%s' % (dom, self.error_urls[dom]))
config.append('')
if self.ui_sspec or self.ui_password or self.ui_pemfile:
config.extend([
'##[ Built-in HTTPD settings ]##',
p('httpd = %s:%s', self.ui_sspec_cfg, ('host', 'port'))
])
if self.ui_password: config.append('httppass=%s' % self.ui_password)
if self.ui_pemfile: config.append('pemfile=%s' % self.ui_pemfile)
for http_host in sorted(self.ui_paths.keys()):
for path in sorted(self.ui_paths[http_host].keys()):
up = self.ui_paths[http_host][path]
config.append('webpath = %s:%s:%s:%s' % (http_host, path, up[0], up[1]))
config.append('')
config.append('##[ Back-ends and local services ]##')
bprinted = 0
for bid in sorted(self.backends.keys()):
be = self.backends[bid]
proto, domain = bid.split(':')
if be[BE_BHOST]:
be_spec = (be[BE_BHOST], be[BE_BPORT])
be_spec = ((be_spec == self.ui_sspec) and 'localhost:builtin'
or ('%s:%s' % be_spec))
fe_spec = ('%s:%s' % (proto, (domain == self.kitename) and '@kitename'
or domain))
secret = ((be[BE_SECRET] == self.kitesecret) and '@kitesecret'
or be[BE_SECRET])
config.append(('%s = %-33s: %-18s: %s'
) % ((be[BE_STATUS] == BE_STATUS_DISABLED
) and 'service_off' or 'service_on ',
fe_spec, be_spec, secret))
bprinted += 1
if bprinted == 0:
config.append('# No back-ends! How boring!')
config.append('')
for http_host in sorted(self.be_config.keys()):
for key in sorted(self.be_config[http_host].keys()):
config.append(('service_cfg = %-30s: %-15s: %s'
) % (http_host, key, self.be_config[http_host][key]))
config.append('')
if bprinted == 0:
new = True
config.extend([
'##[ Back-end service examples ... ]##',
'#',
'# service_on = http:YOU.pagekite.me:localhost:80:SECRET',
'# service_on = ssh:YOU.pagekite.me:localhost:22:SECRET',
'# service_on = http/8080:YOU.pagekite.me:localhost:8080:SECRET',
'# service_on = https:YOU.pagekite.me:localhost:443:SECRET',
'# service_on = websocket:YOU.pagekite.me:localhost:8080:SECRET',
'# service_on = minecraft:YOU.pagekite.me:localhost:8080:SECRET',
'#',
'# service_off = http:YOU.pagekite.me:localhost:4545:SECRET',
''
])
config.extend([
'##[ Allow risky known-to-be-risky incoming HTTP requests? ]##',
(self.insecure) and 'insecure' or '# insecure',
''
])
if self.isfrontend or new:
config.extend([
'##[ Front-end Options ]##',
(self.isfrontend and 'isfrontend' or '# isfrontend')
])
comment = ((not self.isfrontend) and '# ' or '')
config.extend([
p('host = %s', self.isfrontend and self.server_host, 'machine.domain.com'),
'%sports = %s' % (comment, ','.join(['%s' % x for x in sorted(self.server_ports)] or [])),
'%sprotos = %s' % (comment, ','.join(['%s' % x for x in sorted(self.server_protos)] or []))
])
for pa in self.server_portalias:
config.append('portalias = %s:%s' % (int(pa), int(self.server_portalias[pa])))
config.extend([
'%srawports = %s' % (comment or (not self.server_raw_ports) and '# ' or '',
','.join(['%s' % x for x in sorted(self.server_raw_ports)] or [VIRTUAL_PN])),
p('auththreads = %s', self.isfrontend and self.auth_threads, 1),
p('authdomain = %s', self.isfrontend and self.auth_domain, 'foo.com'),
p('motd = %s', self.isfrontend and self.motd, '/path/to/motd.txt')
])
for d in sorted(self.auth_domains.keys()):
config.append('authdomain=%s:%s' % (d, self.auth_domains[d]))
dprinted = 0
for bid in sorted(self.backends.keys()):
be = self.backends[bid]
if not be[BE_BHOST]:
config.append('domain = %s:%s' % (bid, be[BE_SECRET]))
dprinted += 1
if not dprinted:
new = True
config.extend([
'# domain = http:*.pagekite.me:SECRET1',
'# domain = http,https,websocket:THEM.pagekite.me:SECRET2',
])
eprinted = 0
config.extend([
'',
'##[ Domains we terminate SSL/TLS for natively, with key/cert-files ]##'
])
for ep in sorted(self.tls_endpoints.keys()):
config.append('tls_endpoint = %s:%s' % (ep, self.tls_endpoints[ep][0]))
eprinted += 1
if eprinted == 0:
new = True
config.append('# tls_endpoint = DOMAIN:PEM_FILE')
config.extend([
p('tls_default = %s', self.tls_default, 'DOMAIN'),
p('tls_legacy = %s', self.tls_legacy, False),
'',
])
config.extend([
'##[ Proxy-chain settings ]##',
(self.no_proxy and 'noproxy' or '# noproxy'),
])
for proxy in self.proxy_servers:
config.append('proxy = %s' % proxy)
if not self.proxy_servers:
config.extend([
'# socksify = host:port',
'# torify = host:port',
'# proxy = ssl:/path/to/client-cert.pem@host,CommonName:port',
'# proxy = http://user:password@host:port/',
'# proxy = socks://user:password@host:port/'
])
config.extend([
'',
'##[ Front-end access controls (default=deny, if configured) ]##',
p('accept_acl_file = %s', self.accept_acl_file, '/path/to/file'),
])
for policy, pattern in self.client_acls:
config.append('client_acl=%s:%s' % (policy, pattern))
if not self.client_acls:
config.append('# client_acl=[allow|deny]:IP-regexp')
for policy, pattern in self.tunnel_acls:
config.append('tunnel_acl=%s:%s' % (policy, pattern))
if not self.tunnel_acls:
config.append('# tunnel_acl=[allow|deny]:IP-regexp')
config.extend([
'',
'',
'###[ Anything below this line can usually be ignored. ]#########',
'',
'##[ Miscellaneous settings ]##',
p('logfile = %s', self.logfile, '/path/to/file'),
p('buffers = %s', self.buffer_max, DEFAULT_BUFFER_MAX),
(self.servers_new_only is True) and 'new' or '# new',
(self.require_all and 'all' or '# all'),
(self.no_probes and 'noprobes' or '# noprobes'),
(self.crash_report_url and '# nocrashreport' or 'nocrashreport'),
p('savefile = %s', safe and self.savefile, '/path/to/savefile'),
'',
])
if self.daemonize or self.setuid or self.setgid or self.pidfile or new:
config.extend([
'##[ Systems administration settings ]##',
(self.daemonize and 'daemonize' or '# daemonize')
])
if self.setuid and self.setgid:
config.append('runas = %s:%s' % (self.setuid, self.setgid))
elif self.setuid:
config.append('runas = %s' % self.setuid)
else:
new = True
config.append('# runas = uid:gid')
config.append(p('pidfile = %s', self.pidfile, '/path/to/file'))
config.extend([
'',
'###[ End of pagekite.py configuration ]#########',
'END',
''
])
if not new:
config = [l for l in config if not l.startswith('# ')]
clean_config = []
for i in range(0, len(config)-1):
if i > 0 and (config[i].startswith('#') or config[i] == ''):
if config[i+1] != '' or clean_config[-1].startswith('#'):
clean_config.append(config[i])
else:
clean_config.append(config[i])
clean_config.append(config[-1])
return clean_config
else:
return config
def ConfigSecret(self, new=False):
# This method returns a stable secret for the lifetime of this process.
#
# The secret depends on the active configuration as, reported by
# GenerateConfig(). This lets external processes generate the same
# secret and use the remote-control APIs as long as they can read the
# *entire* config (which contains all the sensitive bits anyway).
#
if self.ui_httpd and self.ui_httpd.httpd and not new:
return self.ui_httpd.httpd.secret
else:
return sha1hex('\n'.join(self.GenerateConfig()))
def LoginPath(self, goto):
return '/_pagekite/login/%s/%s' % (self.ConfigSecret(), goto)
def LoginUrl(self, goto=''):
return 'http%s://%s%s' % (self.ui_pemfile and 's' or '',
'%s:%s' % self.ui_sspec,
self.LoginPath(goto))
def ListKites(self):
self.ui.welcome = '>>> ' + self.ui.WHITE + 'Your kites:' + self.ui.NORM
message = []
for bid in sorted(self.backends.keys()):
be = self.backends[bid]
be_be = (be[BE_BHOST], be[BE_BPORT])
backend = (be_be == self.ui_sspec) and 'builtin' or '%s:%s' % be_be
fe_port = be[BE_PORT] or ''
frontend = '%s://%s%s%s' % (be[BE_PROTO], be[BE_DOMAIN],
fe_port and ':' or '', fe_port)
if be[BE_STATUS] == BE_STATUS_DISABLED:
color = self.ui.GREY
status = '(disabled)'
else:
color = self.ui.NORM
status = (be[BE_PROTO] == 'raw') and '(HTTP proxied)' or ''
message.append(''.join([color, backend, ' ' * (19-len(backend)),
frontend, ' ' * (42-len(frontend)), status]))
message.append(self.ui.NORM)
self.ui.Tell(message)
def PrintSettings(self, safe=False):
print '\n'.join(self.GenerateConfig(safe=safe))
def SaveUserConfig(self, quiet=False):
self.savefile = self.savefile or self.rcfile
try:
fd = SecureCreate(self.savefile)
fd.write('\n'.join(self.GenerateConfig(safe=True)))
fd.close()
if not quiet:
self.ui.Tell(['Settings saved to: %s' % self.savefile])
self.ui.Spacer()
logging.Log([('saved', 'Settings saved to: %s' % self.savefile)])
except Exception, e:
if logging.DEBUG_IO: traceback.print_exc(file=sys.stderr)
self.ui.Tell(['Could not save to %s: %s' % (self.savefile, e)],
error=True)
self.ui.Spacer()
def FallDown(self, message, help=True, longhelp=False, noexit=False):
if self.conns and self.conns.auth_pool:
for th in self.conns.auth_pool:
th.quit()
if self.ui_httpd:
self.ui_httpd.quit()
if self.ui_comm:
self.ui_comm.quit()
if self.tunnel_manager:
self.tunnel_manager.quit()
self.keep_looping = False
for fd in (self.conns and self.conns.Sockets() or []):
try:
fd.close()
except (IOError, OSError, TypeError, AttributeError):
pass
self.conns = self.ui_httpd = self.ui_comm = self.tunnel_manager = None
try:
os.dup2(sys.stderr.fileno(), sys.stdout.fileno())
except:
pass
print
if help or longhelp:
import manual
print longhelp and manual.DOC() or manual.MINIDOC()
print '***'
elif not noexit:
self.ui.Status('exiting', message=(message or 'Good-bye!'))
if message:
print 'Error: %s' % message
if logging.DEBUG_IO:
traceback.print_exc(file=sys.stderr)
if not noexit:
self.main_loop = False
sys.exit(1)
def GetTlsEndpointCtx(self, domain):
if domain in self.tls_endpoints:
return self.tls_endpoints[domain][1]
parts = domain.split('.')
# Check for wildcards ...
if len(parts) > 2:
parts[0] = '*'
domain = '.'.join(parts)
if domain in self.tls_endpoints:
return self.tls_endpoints[domain][1]
return None
def SetBackendStatus(self, domain, proto='', add=None, sub=None):
match = '%s:%s' % (proto, domain)
for bid in self.backends:
if bid == match or (proto == '' and bid.endswith(match)):
status = self.backends[bid][BE_STATUS]
if add: self.backends[bid][BE_STATUS] |= add
if sub and (status & sub): self.backends[bid][BE_STATUS] -= sub
logging.Log([('bid', bid),
('status', '0x%x' % self.backends[bid][BE_STATUS])])
def GetBackendData(self, proto, domain, recurse=True):
backend = '%s:%s' % (proto.lower(), domain.lower())
if backend in self.backends:
if self.backends[backend][BE_STATUS] not in BE_INACTIVE:
return self.backends[backend]
if recurse:
dparts = domain.split('.')
while len(dparts) > 1:
dparts = dparts[1:]
data = self.GetBackendData(proto, '.'.join(['*'] + dparts), recurse=False)
if data: return data
return None
def GetBackendServer(self, proto, domain, recurse=True):
backend = self.GetBackendData(proto, domain) or BE_NONE
bhost, bport = (backend[BE_BHOST], backend[BE_BPORT])
if bhost == '-' or not bhost: return None, None
return (bhost, bport), backend
def IsSignatureValid(self, sign, secret, proto, domain, srand, token):
return checkSignature(sign=sign, secret=secret,
payload='%s:%s:%s:%s' % (proto, domain, srand, token))
def LookupDomainQuota(self, lookup):
if not lookup.endswith('.'): lookup += '.'
if logging.DEBUG_IO: print '=== AUTH LOOKUP\n%s\n===' % lookup
(hn, al, ips) = socket.gethostbyname_ex(lookup)
if logging.DEBUG_IO: print 'hn=%s\nal=%s\nips=%s\n' % (hn, al, ips)
# Extract auth error and extended quota info from CNAME replies
if al:
error, hg, hd, hc, junk = hn.split('.', 4)
q_days = int(hd, 16)
q_conns = int(hc, 16)
else:
error = q_days = q_conns = None
# If not an authentication error, quota should be encoded as an IP.
ip = ips[0]
if ip.startswith(AUTH_ERRORS):
if not error and (ip.endswith(AUTH_ERR_USER_UNKNOWN) or
ip.endswith(AUTH_ERR_INVALID)):
error = 'unauthorized'
else:
o = [int(x) for x in ip.split('.')]
return ((((o[0]*256 + o[1])*256 + o[2])*256 + o[3]), q_days, q_conns, None)
# Errors on real errors are final.
if not ip.endswith(AUTH_ERR_USER_UNKNOWN): return (None, q_days, q_conns, error)
# User unknown, fall through to local test.
return (-1, q_days, q_conns, error)
def GetDomainQuota(self, protoport, domain, srand, token, sign,
recurse=True, check_token=True):
if '-' in protoport:
try:
proto, port = protoport.split('-', 1)
if proto == 'raw':
port_list = self.server_raw_ports
else:
port_list = self.server_ports
porti = int(port)
if porti in self.server_aliasport: porti = self.server_aliasport[porti]
if porti not in port_list and VIRTUAL_PN not in port_list:
logging.LogInfo('Unsupported port request: %s (%s:%s)' % (porti, protoport, domain))
return (None, None, None, 'port')
except ValueError:
logging.LogError('Invalid port request: %s:%s' % (protoport, domain))
return (None, None, None, 'port')
else:
proto, port = protoport, None
if proto not in self.server_protos:
logging.LogInfo('Invalid proto request: %s:%s' % (protoport, domain))
return (None, None, None, 'proto')
data = '%s:%s:%s' % (protoport, domain, srand)
auth_error_type = None
if ((not token) or
(not check_token) or
checkSignature(sign=token, payload=data)):
secret = (self.GetBackendData(protoport, domain) or BE_NONE)[BE_SECRET]
if not secret:
secret = (self.GetBackendData(proto, domain) or BE_NONE)[BE_SECRET]
if secret:
if self.IsSignatureValid(sign, secret, protoport, domain, srand, token):
return (-1, None, None, None)
elif not self.auth_domain:
logging.LogError('Invalid signature for: %s (%s)' % (domain, protoport))
return (None, None, None, auth_error_type or 'signature')
if self.auth_domain:
adom = self.auth_domain
for dom in self.auth_domains:
if domain.endswith('.%s' % dom):
adom = self.auth_domains[dom]
try:
lookup = '.'.join([srand, token, sign, protoport,
domain.replace('*', '_any_'), adom])
(rv, qd, qc, auth_error_type) = self.LookupDomainQuota(lookup)
if rv is None or rv >= 0:
return (rv, qd, qc, auth_error_type)
except Exception, e:
# Lookup failed, fail open.
logging.LogError('Quota lookup failed: %s' % e)
return (-2, None, None, None)
logging.LogInfo('No authentication found for: %s (%s)' % (domain, protoport))
return (None, None, None, auth_error_type or 'unauthorized')
def Overloaded(self):
if not self.overload or not self.conns:
return False
return (len(self.conns.conns) > self.overload)
def ConfigureFromFile(self, filename=None, data=None):
if not filename: filename = self.rcfile
if self.rcfile_recursion > 25:
raise ConfigError('Nested too deep: %s' % filename)
self.rcfiles_loaded.append(filename)
optfile = data or open(filename)
args = []
for line in optfile:
line = line.strip()
if line and not line.startswith('#'):
if line.startswith('END'): break
if not line.startswith('-'): line = '--%s' % line
args.append(re.sub(r'\s*:\s*', ':', re.sub(r'\s*=\s*', '=', line)))
self.rcfile_recursion += 1
self.Configure(args)
self.rcfile_recursion -= 1
return self
def ConfigureFromDirectory(self, dirname):
for fn in sorted(os.listdir(dirname)):
if not fn.startswith('.') and fn.endswith('.rc'):
self.ConfigureFromFile(os.path.join(dirname, fn))
def HelpAndExit(self, longhelp=False):
import manual
print longhelp and manual.DOC() or manual.MINIDOC()
sys.exit(0)
def AddNewKite(self, kitespec, status=BE_STATUS_UNKNOWN, secret=None):
new_specs = self.ArgToBackendSpecs(kitespec, status, secret)
self.backends.update(new_specs)
req = {}
for server in self.conns.TunnelServers():
req[server] = '\r\n'.join(PageKiteRequestHeaders(server, new_specs, {}))
for tid, tunnels in self.conns.tunnels.iteritems():
for tunnel in tunnels:
server_name = tunnel.server_info[tunnel.S_NAME]
if server_name in req:
tunnel.SendChunked('NOOP: 1\r\n%s\r\n\r\n!' % req[server_name],
compress=False)
del req[server_name]
def ArgToBackendSpecs(self, arg, status=BE_STATUS_UNKNOWN, secret=None):
protos, fe_domain, be_host, be_port = '', '', '', ''
# Interpret the argument into a specification of what we want.
parts = arg.split(':')
if len(parts) == 5:
protos, fe_domain, be_host, be_port, secret = parts
elif len(parts) == 4:
protos, fe_domain, be_host, be_port = parts
elif len(parts) == 3:
protos, fe_domain, be_port = parts
elif len(parts) == 2:
if (parts[1] == 'builtin') or ('.' in parts[0] and
os.path.exists(parts[1])):
fe_domain, be_port = parts[0], parts[1]
protos = 'http'
else:
try:
fe_domain, be_port = parts[0], '%s' % int(parts[1])
protos = 'http'
except:
be_port = ''
protos, fe_domain = parts
elif len(parts) == 1:
fe_domain = parts[0]
else:
return {}
# Allow http:// as a common typo instead of http:
fe_domain = fe_domain.replace('/', '').lower()
# Allow easy referencing of built-in HTTPD
if be_port == 'builtin':
self.BindUiSspec()
be_host, be_port = self.ui_sspec
# Specs define what we are searching for...
specs = []
if protos:
for proto in protos.replace('/', '-').lower().split(','):
if proto == 'ssh':
specs.append(['raw', '22', fe_domain, be_host, be_port or '22', secret])
else:
if '-' in proto:
proto, port = proto.split('-')
else:
if len(parts) == 1:
port = '*'
else:
port = ''
specs.append([proto, port, fe_domain, be_host, be_port, secret])
else:
specs = [[None, '', fe_domain, be_host, be_port, secret]]
backends = {}
# For each spec, search through the existing backends and copy matches
# or just shared secrets for partial matches.
for proto, port, fdom, bhost, bport, sec in specs:
matches = 0
for bid in self.backends:
be = self.backends[bid]
if fdom and fdom != be[BE_DOMAIN]: continue
if not sec and be[BE_SECRET]: sec = be[BE_SECRET]
if proto and (proto != be[BE_PROTO]): continue
if bhost and (bhost.lower() != be[BE_BHOST]): continue
if bport and (int(bport) != be[BE_BHOST]): continue
if port and (port != '*') and (int(port) != be[BE_PORT]): continue
backends[bid] = be[:]
backends[bid][BE_STATUS] = status
matches += 1
if matches == 0:
proto = (proto or 'http')
bhost = (bhost or 'localhost')
bport = (bport or (proto in ('http', 'httpfinger', 'websocket') and 80)
or (proto == 'irc' and 6667)
or (proto == 'https' and 443)
or (proto == 'minecraft' and 25565)
or (proto == 'finger' and 79))
if port:
bid = '%s-%d:%s' % (proto, int(port), fdom)
else:
bid = '%s:%s' % (proto, fdom)
backends[bid] = BE_NONE[:]
backends[bid][BE_PROTO] = proto
backends[bid][BE_PORT] = port and int(port) or ''
backends[bid][BE_DOMAIN] = fdom
backends[bid][BE_BHOST] = bhost.lower()
backends[bid][BE_BPORT] = int(bport)
backends[bid][BE_SECRET] = sec
backends[bid][BE_STATUS] = status
return backends
def BindUiSspec(self, force=False):
# Create the UI thread
if self.ui_httpd and self.ui_httpd.httpd:
if not force: return self.ui_sspec
self.ui_httpd.httpd.socket.close()
self.ui_sspec = self.ui_sspec or ('localhost', 0)
self.ui_httpd = HttpUiThread(self, self.conns,
handler=self.ui_request_handler,
server=self.ui_http_server,
ssl_pem_filename = self.ui_pemfile)
return self.ui_sspec
def LoadMOTD(self):
if self.motd:
try:
f = open(self.motd, 'r')
self.motd_message = ''.join(f.readlines()).strip()[:8192]
f.close()
except (OSError, IOError):
pass
def SetPem(self, filename):
self.ui_pemfile = filename
try:
p = os.popen('openssl x509 -noout -fingerprint -in %s' % filename, 'r')
data = p.read().strip()
p.close()
self.ui_pemfingerprint = data.split('=')[1]
except (OSError, ValueError):
pass
def Configure(self, argv):
self.conns = self.conns or Connections(self)
opts, args = getopt.getopt(argv, OPT_FLAGS, OPT_ARGS)
for opt, arg in opts:
if opt in ('-o', '--optfile'):
self.ConfigureFromFile(arg)
elif opt in ('-O', '--optdir'):
self.ConfigureFromDirectory(arg)
elif opt in ('-S', '--savefile'):
if self.savefile: raise ConfigError('Multiple save-files!')
self.savefile = arg
elif opt == '--shell':
self.shell = True
elif opt == '--save':
self.save = True
elif opt == '--only':
self.save = self.kite_only = True
if self.kite_remove or self.kite_add or self.kite_disable:
raise ConfigError('One change at a time please!')
elif opt == '--add':
self.save = self.kite_add = True
if self.kite_remove or self.kite_only or self.kite_disable:
raise ConfigError('One change at a time please!')
elif opt == '--remove':
self.save = self.kite_remove = True
if self.kite_add or self.kite_only or self.kite_disable:
raise ConfigError('One change at a time please!')
elif opt == '--disable':
self.save = self.kite_disable = True
if self.kite_add or self.kite_only or self.kite_remove:
raise ConfigError('One change at a time please!')
elif opt == '--list': pass
elif opt in ('-I', '--pidfile'): self.pidfile = arg
elif opt in ('-L', '--logfile'): self.logfile = arg
elif opt in ('-Z', '--daemonize'):
self.daemonize = True
if not self.ui.DAEMON_FRIENDLY: self.ui = NullUi()
elif opt in ('-U', '--runas'):
import pwd
import grp
parts = arg.split(':')
if len(parts) > 1:
self.setuid, self.setgid = (pwd.getpwnam(parts[0])[2],
grp.getgrnam(parts[1])[2])
else:
self.setuid = pwd.getpwnam(parts[0])[2]
self.main_loop = False
elif opt in ('-X', '--httppass'): self.ui_password = arg
elif opt in ('-P', '--pemfile'): self.SetPem(arg)
elif opt in ('--selfsign', ):
pf = self.rcfile.replace('.rc', '.pem').replace('.cfg', '.pem')
if not os.path.exists(pf):
CreateSelfSignedCert(pf, self.ui)
self.SetPem(pf)
elif opt in ('-H', '--httpd'):
parts = arg.split(':')
host = parts[0] or 'localhost'
if len(parts) > 1:
self.ui_sspec = self.ui_sspec_cfg = (host, int(parts[1]))
else:
self.ui_sspec = self.ui_sspec_cfg = (host, 0)
elif opt == '--nowebpath':
host, path = arg.split(':', 1)
if host in self.ui_paths and path in self.ui_paths[host]:
del self.ui_paths[host][path]
elif opt == '--webpath':
host, path, policy, fpath = arg.split(':', 3)
# Defaults...
path = path or os.path.normpath(fpath)
host = host or '*'
policy = policy or WEB_POLICY_DEFAULT
if policy not in WEB_POLICIES:
raise ConfigError('Policy must be one of: %s' % WEB_POLICIES)
elif os.path.isdir(fpath):
if not path.endswith('/'): path += '/'
hosti = self.ui_paths.get(host, {})
hosti[path] = (policy or 'public', os.path.abspath(fpath))
self.ui_paths[host] = hosti
elif opt == '--tls_default': self.tls_default = arg
elif opt == '--tls_legacy': self.tls_legacy = True
elif opt == '--tls_endpoint':
name, pemfile = arg.split(':', 1)
ctx = socks.MakeBestEffortSSLContext(legacy=self.tls_legacy)
ctx.use_privatekey_file(pemfile)
ctx.use_certificate_chain_file(pemfile)
self.tls_endpoints[name] = (pemfile, ctx)
elif opt in ('-D', '--dyndns'):
if arg.startswith('http'):
self.dyndns = (arg, {'user': '', 'pass': ''})
elif '@' in arg:
splits = arg.split('@')
provider = splits.pop()
usrpwd = '@'.join(splits)
if provider in DYNDNS: provider = DYNDNS[provider]
if ':' in usrpwd:
usr, pwd = usrpwd.split(':', 1)
self.dyndns = (provider, {'user': usr, 'pass': pwd})
else:
self.dyndns = (provider, {'user': usrpwd, 'pass': ''})
elif arg:
if arg in DYNDNS: arg = DYNDNS[arg]
self.dyndns = (arg, {'user': '', 'pass': ''})
else:
self.dyndns = None
elif opt in ('-p', '--ports'):
self.server_ports = [int(x) for x in arg.split(',')]
elif opt == '--portalias':
port, alias = arg.split(':')
self.server_portalias[int(port)] = int(alias)
self.server_aliasport[int(alias)] = int(port)
elif opt == '--protos': self.server_protos = [x.lower() for x in arg.split(',')]
elif opt == '--rawports':
self.server_raw_ports = [(x == VIRTUAL_PN and x or int(x)) for x in arg.split(',')]
elif opt in ('-h', '--host'): self.server_host = arg
elif opt == '--auththreads':
self.auth_threads = int(arg)
elif opt in ('-A', '--authdomain'):
if ':' in arg:
d, a = arg.split(':')
self.auth_domains[d.lower()] = a
if not self.auth_domain: self.auth_domain = a
else:
self.auth_domains = {}
self.auth_domain = arg
elif opt == '--motd':
self.motd = arg
self.LoadMOTD()
elif opt == '--noupgradeinfo': self.upgrade_info = []
elif opt == '--upgradeinfo':
version, tag, md5, human_url, file_url = arg.split(';')
self.upgrade_info.append((version, tag, md5, human_url, file_url))
elif opt == '--keepalive':
if arg == 'auto':
self.keepalive = None
else:
self.keepalive = max(PING_INTERVAL_MIN, int(arg))
elif opt in ('-f', '--isfrontend'):
self.isfrontend = True
logging.LOG_THRESHOLD *= 4
elif opt in ('-a', '--all'): self.require_all = True
elif opt in ('-N', '--new'): self.servers_new_only = True
elif opt == '--accept_acl_file':
self.accept_acl_file = arg
elif opt == '--client_acl':
policy, pattern = arg.split(':', 1)
self.client_acls.append((policy, pattern))
elif opt == '--tunnel_acl':
policy, pattern = arg.split(':', 1)
self.tunnel_acls.append((policy, pattern))
elif opt in ('--noproxy', ):
self.no_proxy = True
self.proxy_servers = []
socks.setdefaultproxy()
elif opt in ('--proxy', '--socksify', '--torify'):
if opt == '--proxy':
socks.adddefaultproxy(*socks.parseproxy(arg))
else:
(host, port) = arg.rsplit(':', 1)
socks.adddefaultproxy(socks.PROXY_TYPE_SOCKS5, host, int(port))
if not self.proxy_servers:
# Make DynDNS updates go via the proxy.
socks.wrapmodule(urllib)
self.proxy_servers = [arg]
else:
self.proxy_servers.append(arg)
if opt == '--torify':
self.servers_new_only = True # Disable initial DNS lookups (leaks)
self.servers_no_ping = True # Disable front-end pings
self.crash_report_url = None # Disable crash reports
# This increases the odds of unrelated requests getting lumped
# together in the tunnel, which makes traffic analysis harder.
compat.SEND_ALWAYS_BUFFERS = True
elif opt == '--ca_certs':
if arg == 'auto':
self.SetDefaultCACerts(use_curl_bundle=True)
else:
self.ca_certs = arg
elif opt == '--fe_certname':
if arg == '':
self.fe_certname = []
else:
cert = arg.lower()
if cert not in self.fe_certname: self.fe_certname.append(cert)
elif opt == '--fe_nocertcheck':
self.fe_nocertcheck = True
elif opt == '--service_xmlrpc': self.service_xmlrpc = arg
elif opt == '--frontend': self.servers_manual.append(arg)
elif opt == '--nofrontend': self.servers_never.append(arg)
elif opt == '--frontends':
count, domain, port = arg.split(':')
self.servers_auto = (int(count), domain, int(port))
elif opt in ('--errorurl', '-E'):
if ':http' in arg:
dom, url = arg.split(':', 1)
self.error_urls[dom] = url
else:
self.error_url = arg
elif opt == '--fingerpath': self.finger_path = arg
elif opt == '--kitename': self.kitename = arg
elif opt == '--kitesecret': self.kitesecret = arg
elif opt in ('--service_on', '--service_off',
'--backend', '--define_backend'):
if opt in ('--backend', '--service_on'):
status = BE_STATUS_UNKNOWN
else:
status = BE_STATUS_DISABLED
bes = self.ArgToBackendSpecs(arg.replace('@kitesecret', self.kitesecret)
.replace('@kitename', self.kitename),
status=status)
for bid in bes:
if bid in self.backends:
raise ConfigError("Same service/domain defined twice: %s" % bid)
if not self.kitename:
self.kitename = bes[bid][BE_DOMAIN]
self.kitesecret = bes[bid][BE_SECRET]
self.backends.update(bes)
elif opt in ('--be_config', '--service_cfg'):
host, key, val = arg.split(':', 2)
if key.startswith('user/'): key = key.replace('user/', 'password/')
hostc = self.be_config.get(host, {})
hostc[key] = {'True': True, 'False': False, 'None': None}.get(val, val)
self.be_config[host] = hostc
elif opt == '--domain':
protos, domain, secret = arg.split(':')
if protos in ('*', ''): protos = ','.join(self.server_protos)
for proto in protos.split(','):
bid = '%s:%s' % (proto, domain)
if bid in self.backends:
raise ConfigError("Same service/domain defined twice: %s" % bid)
self.backends[bid] = BE_NONE[:]
self.backends[bid][BE_PROTO] = proto
self.backends[bid][BE_DOMAIN] = domain
self.backends[bid][BE_SECRET] = secret
self.backends[bid][BE_STATUS] = BE_STATUS_UNKNOWN
elif opt == '--insecure': self.insecure = True
elif opt == '--noprobes': self.no_probes = True
elif opt == '--nofrontend': self.isfrontend = False
elif opt == '--nodaemonize': self.daemonize = False
elif opt == '--noall': self.require_all = False
elif opt == '--nozchunks': self.disable_zchunks = True
elif opt == '--nullui': self.ui = NullUi()
elif opt == '--remoteui':
import pagekite.ui.remote
self.ui = pagekite.ui.remote.RemoteUi()
elif opt == '--uiport': self.ui_port = int(arg)
elif opt == '--sslzlib': self.enable_sslzlib = True
elif opt == '--watch':
self.watch_level[0] = int(arg)
elif opt == '--overload':
self.overload = int(arg)
elif opt == '--debugio':
logging.DEBUG_IO = True
elif opt == '--buffers': self.buffer_max = int(arg)
elif opt == '--nocrashreport': self.crash_report_url = None
elif opt == '--noloop': self.main_loop = False
elif opt == '--local':
self.SetLocalSettings([int(p) for p in arg.split(',')])
if not 'localhost' in args: args.append('localhost')
elif opt == '--defaults': self.SetServiceDefaults()
elif opt == '--whitelabel': self.SetWhitelabelDefaults(arg, secure=False)
elif opt == '--whitelabels': self.SetWhitelabelDefaults(arg, secure=True)
elif opt in ('--clean', '--nopyopenssl', '--nossl', '--settings',
'--signup', '--friendly'):
# These are handled outside the main loop, we just ignore them.
pass
elif opt in ('--webroot', '--webaccess', '--webindexes',
'--noautosave', '--autosave', '--reloadfile',
'--delete_backend'):
# FIXME: These are deprecated, we should probably warn the user.
pass
elif opt == '--help':
self.HelpAndExit(longhelp=True)
elif opt == '--controlpanel':
import webbrowser
webbrowser.open(self.LoginUrl())
sys.exit(0)
elif opt == '--controlpass':
print self.ConfigSecret()
sys.exit(0)
else:
self.HelpAndExit()
# Make sure these are configured before we try and do XML-RPC stuff.
socks.DEBUG = (logging.DEBUG_IO or socks.DEBUG) and logging.LogDebug
if self.ca_certs:
socks.setdefaultcertfile(self.ca_certs)
# Handle the user-friendly argument stuff and simple registration.
return self.ParseFriendlyBackendSpecs(args)
def ParseFriendlyBackendSpecs(self, args):
just_these_backends = {}
just_these_webpaths = {}
just_these_be_configs = {}
argsets = []
while 'AND' in args:
argsets.append(args[0:args.index('AND')])
args[0:args.index('AND')+1] = []
if args:
argsets.append(args)
for args in argsets:
# Extract the config options first...
be_config = [p for p in args if p.startswith('+')]
args = [p for p in args if not p.startswith('+')]
fe_spec = (args.pop().replace('@kitesecret', self.kitesecret)
.replace('@kitename', self.kitename))
if os.path.exists(fe_spec):
raise ConfigError('Is a local file: %s' % fe_spec)
be_paths = []
be_path_prefix = ''
if len(args) == 0:
be_spec = ''
elif len(args) == 1:
if '*' in args[0] or '?' in args[0]:
if sys.platform[:3] in ('win', 'os2'):
be_paths = [args[0]]
be_spec = 'builtin'
elif os.path.exists(args[0]):
be_paths = [args[0]]
be_spec = 'builtin'
else:
be_spec = args[0]
else:
be_spec = 'builtin'
be_paths = args[:]
be_proto = 'http' # A sane default...
if be_spec == '':
be = None
else:
be = be_spec.replace('/', '').split(':')
if be[0].lower() in ('http', 'http2', 'http3', 'https',
'httpfinger', 'finger', 'ssh', 'irc'):
be_proto = be.pop(0)
if len(be) < 2:
be.append({'http': '80', 'http2': '80', 'http3': '80',
'https': '443', 'irc': '6667',
'httpfinger': '80', 'finger': '79',
'ssh': '22'}[be_proto])
if len(be) > 2:
raise ConfigError('Bad back-end definition: %s' % be_spec)
if len(be) < 2:
try:
if be[0] != 'builtin':
int(be[0])
be = ['localhost', be[0]]
except ValueError:
raise ConfigError('`%s` should be a file, directory, port or '
'protocol' % be_spec)
# Extract the path prefix from the fe_spec
fe_urlp = fe_spec.split('/', 3)
if len(fe_urlp) == 4:
fe_spec = '/'.join(fe_urlp[:3])
be_path_prefix = '/' + fe_urlp[3]
fe = fe_spec.replace('/', '').split(':')
if len(fe) == 3:
fe = ['%s-%s' % (fe[0], fe[2]), fe[1]]
elif len(fe) == 2:
try:
fe = ['%s-%s' % (be_proto, int(fe[1])), fe[0]]
except ValueError:
pass
elif len(fe) == 1 and be:
fe = [be_proto, fe[0]]
# Do our own globbing on Windows
if sys.platform[:3] in ('win', 'os2'):
import glob
new_paths = []
for p in be_paths:
new_paths.extend(glob.glob(p))
be_paths = new_paths
for f in be_paths:
if not os.path.exists(f):
raise ConfigError('File or directory not found: %s' % f)
spec = ':'.join(fe)
if be: spec += ':' + ':'.join(be)
specs = self.ArgToBackendSpecs(spec)
just_these_backends.update(specs)
spec = specs[specs.keys()[0]]
http_host = '%s/%s' % (spec[BE_DOMAIN], spec[BE_PORT] or '80')
if be_config:
# Map the +foo=bar values to per-site config settings.
host_config = just_these_be_configs.get(http_host, {})
for cfg in be_config:
if '=' in cfg:
key, val = cfg[1:].split('=', 1)
elif cfg.startswith('+no'):
key, val = cfg[3:], False
else:
key, val = cfg[1:], True
if ':' in key:
raise ConfigError('Please do not use : in web config keys.')
if key.startswith('user/'): key = key.replace('user/', 'password/')
host_config[key] = val
just_these_be_configs[http_host] = host_config
if be_paths:
host_paths = just_these_webpaths.get(http_host, {})
host_config = just_these_be_configs.get(http_host, {})
rand_seed = '%s:%x' % (specs[specs.keys()[0]][BE_SECRET],
time.time()/3600)
first = (len(host_paths.keys()) == 0) or be_path_prefix
paranoid = host_config.get('hide', False)
set_root = host_config.get('root', True)
if len(be_paths) == 1:
skip = len(os.path.dirname(be_paths[0]))
else:
skip = len(os.path.dirname(os.path.commonprefix(be_paths)+'X'))
for path in be_paths:
phead, ptail = os.path.split(path)
if paranoid:
if path.endswith('/'): path = path[0:-1]
webpath = '%s/%s' % (sha1hex(rand_seed+os.path.dirname(path))[0:9],
os.path.basename(path))
elif (first and set_root and os.path.isdir(path)):
webpath = ''
elif (os.path.isdir(path) and
not path.startswith('.') and
not os.path.isabs(path)):
webpath = path[skip:] + '/'
elif path == '.':
webpath = ''
else:
webpath = path[skip:]
while webpath.endswith('/.'):
webpath = webpath[:-2]
host_paths[(be_path_prefix + '/' + webpath).replace('///', '/'
).replace('//', '/')
] = (WEB_POLICY_DEFAULT, os.path.abspath(path))
first = False
just_these_webpaths[http_host] = host_paths
need_registration = {}
for be in just_these_backends.values():
if not be[BE_SECRET]:
if self.kitesecret and be[BE_DOMAIN] == self.kitename:
be[BE_SECRET] = self.kitesecret
elif not self.kite_remove and not self.kite_disable:
need_registration[be[BE_DOMAIN]] = True
for domain in need_registration:
if '.' not in domain:
raise ConfigError('Not valid domain: %s' % domain)
for domain in need_registration:
result = self.RegisterNewKite(kitename=domain)
if not result:
raise ConfigError("Not sure what to do with %s, giving up." % domain)
# Update the secrets...
rdom, rsecret = result
for be in just_these_backends.values():
if be[BE_DOMAIN] == domain: be[BE_SECRET] = rsecret
# Update the kite names themselves, if they changed.
if rdom != domain:
for bid in just_these_backends.keys():
nbid = bid.replace(':'+domain, ':'+rdom)
if nbid != bid:
just_these_backends[nbid] = just_these_backends[bid]
just_these_backends[nbid][BE_DOMAIN] = rdom
del just_these_backends[bid]
if just_these_backends.keys():
if self.kite_add:
self.backends.update(just_these_backends)
elif self.kite_remove:
try:
for bid in just_these_backends:
be = self.backends[bid]
if be[BE_PROTO] in ('http', 'http2', 'http3'):
http_host = '%s/%s' % (be[BE_DOMAIN], be[BE_PORT] or '80')
if http_host in self.ui_paths: del self.ui_paths[http_host]
if http_host in self.be_config: del self.be_config[http_host]
del self.backends[bid]
except KeyError:
raise ConfigError('No such kite: %s' % bid)
elif self.kite_disable:
try:
for bid in just_these_backends:
self.backends[bid][BE_STATUS] = BE_STATUS_DISABLED
except KeyError:
raise ConfigError('No such kite: %s' % bid)
elif self.kite_only:
for be in self.backends.values(): be[BE_STATUS] = BE_STATUS_DISABLED
self.backends.update(just_these_backends)
else:
# Nothing explictly requested: 'only' behavior with a twist;
# If kites are new, don't make disables persist on save.
for be in self.backends.values():
be[BE_STATUS] = (need_registration and BE_STATUS_DISABLE_ONCE
or BE_STATUS_DISABLED)
self.backends.update(just_these_backends)
self.ui_paths.update(just_these_webpaths)
self.be_config.update(just_these_be_configs)
return self
def GetServiceXmlRpc(self):
service = self.service_xmlrpc
return xmlrpclib.ServerProxy(self.service_xmlrpc, None, None, False)
def _KiteInfo(self, kitename):
is_service_domain = kitename and SERVICE_DOMAIN_RE.search(kitename)
is_subdomain_of = is_cname_for = is_cname_ready = False
secret = None
for be in self.backends.values():
if be[BE_SECRET] and (be[BE_DOMAIN] == kitename):
secret = be[BE_SECRET]
if is_service_domain:
parts = kitename.split('.')
if '-' in parts[0]:
parts[0] = '-'.join(parts[0].split('-')[1:])
is_subdomain_of = '.'.join(parts)
elif len(parts) > 3:
is_subdomain_of = '.'.join(parts[1:])
elif kitename:
try:
(hn, al, ips) = socket.gethostbyname_ex(kitename)
if hn != kitename and SERVICE_DOMAIN_RE.search(hn):
is_cname_for = hn
except:
pass
return (secret, is_subdomain_of, is_service_domain,
is_cname_for, is_cname_ready)
def RegisterNewKite(self, kitename=None, first=False,
ask_be=False, autoconfigure=False):
registered = False
if kitename:
(secret, is_subdomain_of, is_service_domain,
is_cname_for, is_cname_ready) = self._KiteInfo(kitename)
if secret:
self.ui.StartWizard('Updating kite: %s' % kitename)
registered = True
else:
self.ui.StartWizard('Creating kite: %s' % kitename)
else:
if first:
self.ui.StartWizard('Create your first kite')
else:
self.ui.StartWizard('Creating a new kite')
is_subdomain_of = is_service_domain = False
is_cname_for = is_cname_ready = False
# This is the default...
be_specs = ['http:%s:localhost:80']
if self.ca_certs == self.ca_certs_default:
# We're using the defaults, but the defaults might be lame so we
# reset them here, allowing for downloading the cURL bundle.
self.SetDefaultCACerts(use_curl_bundle=True)
service = self.GetServiceXmlRpc()
service_accounts = {}
if self.kitename and self.kitesecret:
service_accounts[self.kitename] = self.kitesecret
for be in self.backends.values():
if SERVICE_DOMAIN_RE.search(be[BE_DOMAIN]):
if be[BE_DOMAIN] == is_cname_for:
is_cname_ready = True
if be[BE_SECRET] not in service_accounts.values():
service_accounts[be[BE_DOMAIN]] = be[BE_SECRET]
service_account_list = service_accounts.keys()
if registered:
state = ['choose_backends']
if service_account_list:
state = ['choose_kite_account']
else:
state = ['use_service_question']
history = []
def Goto(goto, back_skips_current=False):
if not back_skips_current: history.append(state[0])
state[0] = goto
def Back():
if history:
state[0] = history.pop(-1)
else:
Goto('abort')
register = is_cname_for or kitename
account = email = None
while 'end' not in state:
try:
if 'use_service_question' in state:
ch = self.ui.AskYesNo('Use the PageKite.net service?',
pre=['Welcome to PageKite!',
'',
'Please answer a few quick questions to',
'create your first kite.',
'',
'By continuing, you agree to play nice',
'and abide by the Terms of Service at:',
'- %s' % (SERVICE_TOS_URL, SERVICE_TOS_URL)],
default=True, back=-1, no='Abort')
if ch is True:
self.SetServiceDefaults(clobber=True)
socks.setdefaultcertfile(self.ca_certs)
if not kitename:
Goto('service_signup_email')
elif is_cname_for and is_cname_ready:
register = kitename
Goto('service_signup_email')
elif is_service_domain:
register = is_cname_for or kitename
if is_subdomain_of:
# FIXME: Shut up if parent is already in local config!
Goto('service_signup_is_subdomain')
else:
Goto('service_signup_email')
else:
Goto('service_signup_bad_domain')
else:
Goto('manual_abort')
elif 'service_login_email' in state:
p = None
while not email or not p:
(email, p) = self.ui.AskLogin('Please log on ...', pre=[
'By logging on to %s,' % self.service_provider,
'you will be able to use this kite',
'with your pre-existing account.'
], email=email, back=(email, False))
if email and p:
try:
self.ui.Working('Logging on to your account')
service_accounts[email] = service.getSharedSecret(email, p)
# FIXME: Should get the list of preconfigured kites via. RPC
# so we don't try to create something that already
# exists? Or should the RPC not just not complain?
account = email
Goto('create_kite')
except:
email = p = None
self.ui.Tell(['Login failed! Try again?'], error=True)
if p is False:
Back()
break
elif ('service_signup_is_subdomain' in state):
ch = self.ui.AskYesNo('Use this name?',
pre=['%s is a sub-domain.' % kitename, '',
'NOTE: This process will fail if you',
'have not already registered the parent',
'domain, %s.' % is_subdomain_of],
default=True, back=-1)
if ch is True:
if account:
Goto('create_kite')
elif email:
Goto('service_signup')
else:
Goto('service_signup_email')
elif ch is False:
Goto('service_signup_kitename')
else:
Back()
elif ('service_signup_bad_domain' in state or
'service_login_bad_domain' in state):
if is_cname_for:
alternate = is_cname_for
ch = self.ui.AskYesNo('Create both?',
pre=['%s is a CNAME for %s.' % (kitename, is_cname_for)],
default=True, back=-1)
else:
alternate = kitename.split('.')[-2]+'.'+SERVICE_DOMAINS[0]
ch = self.ui.AskYesNo('Try to create %s instead?' % alternate,
pre=['Sorry, %s is not a valid service domain.' % kitename],
default=True, back=-1)
if ch is True:
register = alternate
Goto(state[0].replace('bad_domain', 'email'))
elif ch is False:
register = alternate = kitename = False
Goto('service_signup_kitename', back_skips_current=True)
else:
Back()
elif 'service_signup_email' in state:
email = self.ui.AskEmail('What is your e-mail address?',
pre=['We need to be able to contact you',
'now and then with news about the',
'service and your account.',
'',
'Your details will be kept private.'],
back=False)
if email and register:
Goto('service_signup')
elif email:
Goto('service_signup_kitename')
else:
Back()
elif ('service_signup_kitename' in state or
'service_ask_kitename' in state):
try:
self.ui.Working('Fetching list of available domains')
domains = service.getAvailableDomains('', '')
except:
domains = ['.%s' % x for x in SERVICE_DOMAINS_SIGNUP]
ch = self.ui.AskKiteName(domains, 'Name this kite:',
pre=['Your kite name becomes the public name',
'of your personal server or web-site.',
'',
'Names are provided on a first-come,',
'first-serve basis. You can create more',
'kites with different names later on.'],
back=False)
if ch:
kitename = register = ch
(secret, is_subdomain_of, is_service_domain,
is_cname_for, is_cname_ready) = self._KiteInfo(ch)
if secret:
self.ui.StartWizard('Updating kite: %s' % kitename)
registered = True
else:
self.ui.StartWizard('Creating kite: %s' % kitename)
Goto('choose_backends')
else:
Back()
elif 'choose_backends' in state:
if ask_be and autoconfigure:
skip = False
ch = self.ui.AskBackends(kitename, ['http'], ['80'], [],
'Enable which service?', back=False, pre=[
'You control which of your files or servers',
'PageKite exposes to the Internet. ',
], default=','.join(be_specs))
if ch:
be_specs = ch.split(',')
else:
skip = ch = True
if ch:
if registered:
Goto('create_kite', back_skips_current=skip)
elif is_subdomain_of:
Goto('service_signup_is_subdomain', back_skips_current=skip)
elif account:
Goto('create_kite', back_skips_current=skip)
elif email:
Goto('service_signup', back_skips_current=skip)
else:
Goto('service_signup_email', back_skips_current=skip)
else:
Back()
elif 'service_signup' in state:
try:
self.ui.Working('Signing up')
details = service.signUp(email, register)
if details.get('secret', False):
service_accounts[email] = details['secret']
self.ui.AskYesNo('Continue?', pre=[
'Your kite is ready to fly!',
'',
'Note: To complete the signup process,',
'check your e-mail (and spam folders) for',
'activation instructions. You can give',
'PageKite a try first, but un-activated',
'accounts are disabled after %d minutes.' % details['timeout'],
], yes='Finish', no=False, default=True)
self.ui.EndWizard()
if autoconfigure:
for be_spec in be_specs:
self.backends.update(self.ArgToBackendSpecs(
be_spec % register,
secret=details['secret']))
self.added_kites = True
return (register, details['secret'])
else:
error = details.get('error', 'unknown')
except IOError:
error = 'network'
except:
error = '%s' % (sys.exc_info(), )
if error == 'pleaselogin':
self.ui.ExplainError(error, 'Signup failed!',
subject=email)
Goto('service_login_email', back_skips_current=True)
elif error == 'email':
self.ui.ExplainError(error, 'Signup failed!',
subject=register)
Goto('service_login_email', back_skips_current=True)
elif error in ('domain', 'domaintaken', 'subdomain'):
self.ui.ExplainError(error, 'Invalid domain!',
subject=register)
register, kitename = None, None
Goto('service_signup_kitename', back_skips_current=True)
elif error == 'network':
self.ui.ExplainError(error, 'Network error!',
subject=self.service_provider)
Goto('service_signup', back_skips_current=True)
else:
self.ui.ExplainError(error, 'Unknown problem!')
print 'FIXME! Error is %s' % error
Goto('abort')
elif 'choose_kite_account' in state:
choices = service_account_list[:]
choices.append('Use another service provider')
justdoit = (len(service_account_list) == 1)
if justdoit:
ch = 1
else:
ch = self.ui.AskMultipleChoice(choices, 'Register with',
pre=['Choose an account for this kite:'],
default=1)
account = choices[ch-1]
if ch == len(choices):
Goto('manual_abort')
elif kitename:
Goto('choose_backends', back_skips_current=justdoit)
else:
Goto('service_ask_kitename', back_skips_current=justdoit)
elif 'create_kite' in state:
secret = service_accounts[account]
subject = None
cfgs = {}
result = {}
error = None
try:
if registered and kitename and secret:
pass
elif is_cname_for and is_cname_ready:
self.ui.Working('Creating your kite')
subject = kitename
result = service.addCnameKite(account, secret, kitename)
time.sleep(2) # Give the service side a moment to replicate...
else:
self.ui.Working('Creating your kite')
subject = register
result = service.addKite(account, secret, register)
time.sleep(2) # Give the service side a moment to replicate...
for be_spec in be_specs:
cfgs.update(self.ArgToBackendSpecs(be_spec % register,
secret=secret))
if is_cname_for == register and 'error' not in result:
subject = kitename
result.update(service.addCnameKite(account, secret, kitename))
error = result.get('error', None)
if not error:
for be_spec in be_specs:
cfgs.update(self.ArgToBackendSpecs(be_spec % kitename,
secret=secret))
except Exception, e:
error = '%s' % e
if error:
self.ui.ExplainError(error, 'Kite creation failed!',
subject=subject)
Goto('abort')
else:
self.ui.Tell(['Success!'])
self.ui.EndWizard()
if autoconfigure: self.backends.update(cfgs)
self.added_kites = True
return (register or kitename, secret)
elif 'manual_abort' in state:
if self.ui.Tell(['Aborted!', '',
'Please manually add information about your',
'kites and front-ends to the configuration file:',
'', ' %s' % self.rcfile],
error=True, back=False) is False:
Back()
else:
self.ui.EndWizard()
if self.ui.ALLOWS_INPUT: return None
sys.exit(0)
elif 'abort' in state:
self.ui.EndWizard()
if self.ui.ALLOWS_INPUT: return None
sys.exit(0)
else:
raise ConfigError('Unknown state: %s' % state)
except KeyboardInterrupt:
sys.stderr.write('\n')
if history:
Back()
else:
raise KeyboardInterrupt()
self.ui.EndWizard()
return None
def CheckConfig(self):
if self.ui_sspec: self.BindUiSspec()
if (not self.servers_manual and
not self.servers_auto and
not self.isfrontend):
if not self.servers and not self.ui.ALLOWS_INPUT:
raise ConfigError('Nothing to do! List some servers, or run me as one.')
return self
def CheckAllTunnels(self, conns):
missing = []
for backend in self.backends:
proto, domain = backend.split(':')
if not conns.Tunnel(proto, domain):
missing.append(domain)
if missing:
self.FallDown('No tunnel for %s' % missing, help=False)
TMP_UUID_MAP = {
'2400:8900::f03c:91ff:feae:ea35:443': '106.187.99.46:443',
'2a01:7e00::f03c:91ff:fe96:234:443': '178.79.140.143:443',
'2600:3c03::f03c:91ff:fe96:2bf:443': '50.116.52.206:443',
'2600:3c01::f03c:91ff:fe96:257:443': '173.230.155.164:443',
'69.164.211.158:443': '50.116.52.206:443',
}
def Ping(self, host, port):
cid = uuid = '%s:%s' % (host, port)
if cid in self.servers_never:
return (9999, uuid)
if self.servers_no_ping:
return (0, uuid)
while ((cid not in self.ping_cache) or
(len(self.ping_cache[cid]) < 2) or
(time.time()-self.ping_cache[cid][0][0] > 60)):
start = time.time()
try:
try:
if ':' in host:
fd = socks.socksocket(socket.AF_INET6, socket.SOCK_STREAM)
else:
fd = socks.socksocket(socket.AF_INET, socket.SOCK_STREAM)
except:
fd = socks.socksocket(socket.AF_INET, socket.SOCK_STREAM)
try:
fd.settimeout(3.0) # Missing in Python 2.2
except:
fd.setblocking(1)
fd.connect((host, port))
fd.send('HEAD /ping HTTP/1.1\r\nHost: ping.pagekite\r\n\r\n')
data = fd.recv(1024)
fd.close()
if not data.startswith('HTTP/1.1 503 Unavailable'):
raise Exception()
except Exception, e:
logging.LogDebug('Ping %s:%s failed: %s' % (host, port, e))
return (100000, uuid)
elapsed = (time.time() - start)
try:
uuid = data.split('X-PageKite-UUID: ')[1].split()[0]
except:
uuid = self.TMP_UUID_MAP.get(uuid, uuid)
try:
if data.index('X-PageKite-Overloaded:') >= 0:
elapsed += 1 # Simulate slowness: add full second to ping time
except ValueError:
pass
if cid not in self.ping_cache:
self.ping_cache[cid] = []
elif len(self.ping_cache[cid]) > 10:
self.ping_cache[cid][8:] = []
self.ping_cache[cid][0:0] = [(time.time(), (elapsed, uuid))]
window = min(3, len(self.ping_cache[cid]))
pingval = sum([e[1][0] for e in self.ping_cache[cid][:window]])/window
uuid = self.ping_cache[cid][0][1][1]
logging.LogDebug(('Pinged %s:%s: %f [win=%s, uuid=%s]'
) % (host, port, pingval, window, uuid))
return (pingval, uuid)
def GetHostIpAddrs(self, host):
rv = []
try:
info = socket.getaddrinfo(host, 0, socket.AF_UNSPEC, socket.SOCK_STREAM)
rv = [i[4][0] for i in info]
except AttributeError:
rv = socket.gethostbyname_ex(host)[2]
return rv
def CachedGetHostIpAddrs(self, host):
now = int(time.time())
if host in self.dns_cache:
# FIXME: This number (900) is 3x the pagekite.net service DNS TTL, which
# should be about right. BUG: nothing keeps those two numbers in sync!
# This number must be larger, or we prematurely disconnect frontends.
for exp in [t for t in self.dns_cache[host] if t < now-900]:
del self.dns_cache[host][exp]
else:
self.dns_cache[host] = {}
try:
self.dns_cache[host][now] = self.GetHostIpAddrs(host)
except:
logging.LogDebug('DNS lookup failed for %s' % host)
ips = {}
for ipaddrs in self.dns_cache[host].values():
for ip in ipaddrs:
ips[ip] = 1
return ips.keys()
def GetActiveBackends(self, include_loopback=False):
active = []
for bid in self.backends:
(proto, bdom) = bid.split(':')
if (self.backends[bid][BE_STATUS] not in BE_INACTIVE and
(include_loopback or self.backends[bid][BE_SECRET]) and
not bdom.startswith('*')):
active.append(bid)
return active
def ChooseFrontEnds(self, periodic=False):
self.servers = []
self.servers_preferred = []
self.last_frontend_choice = time.time()
servers_all = {}
servers_pref = {}
# Increase our ping interval slightly unless it has been reduced
# to the minimum: that means our connection is crap and we should
# just leave it be.
if (periodic
and not self.keepalive
and not self.isfrontend
and common.PING_INTERVAL > common.PING_INTERVAL_MIN):
common.DISCONNECT_COUNT = 0
common.PING_INTERVAL = min(common.PING_INTERVAL * 1.3,
common.PING_INTERVAL_MAX)
logging.LogDebug('TunnelManager: adjusted ping interval, PI=%s'
% common.PING_INTERVAL)
# Enable internal loopback
if self.isfrontend:
need_loopback = False
for be in self.backends.values():
if be[BE_BHOST]:
need_loopback = True
if need_loopback:
# Note: Add to servers_pref to keep from getting disconnected
servers_all['loopback'] = servers_pref['loopback'] = LOOPBACK_FE
# Process the manually requested servers first (--frontend= lines); these
# are always added (and preferred, so in DNS) no matter what.
def sping(server):
(host, port) = server.split(':')
ipaddrs = self.CachedGetHostIpAddrs(host)
if ipaddrs:
ptime, uuid = self.Ping(ipaddrs[0], int(port))
server = '%s:%s' % (ipaddrs[0], port)
servers_all[uuid] = servers_pref[uuid] = server
threads, deadline = [], time.time() + 5
for server in self.servers_manual:
threads.append(threading.Thread(target=sping, args=(server,)))
threads[-1].daemon = True
threads[-1].start()
for t in threads:
t.join(max(0.1, deadline - time.time()))
# Lookup and choose from the auto-list (and our old domain).
if self.servers_auto:
(count, domain, port) = self.servers_auto
pinged = {}
try:
# First, check for old addresses and always connect to those.
selected = {}
if not self.servers_new_only:
def bping(bid):
(proto, bdom) = bid.split(':')
for ip in self.CachedGetHostIpAddrs(bdom):
# FIXME: What about IPv6 localhost?
if not ip.startswith('127.') and ip not in pinged:
server = '%s:%s' % (ip, port)
pingtime, uuid = pinged[ip] = self.Ping(ip, int(port))
servers_all[uuid] = server
threads, deadline = [], time.time() + 5
for bid in self.GetActiveBackends():
threads.append(threading.Thread(target=bping, args=(bid,)))
threads[-1].daemon = True
threads[-1].start()
for t in threads:
t.join(max(0.1, deadline - time.time()))
ips = [i for i in self.CachedGetHostIpAddrs(domain) if i not in pinged]
def iping(ip):
pinged[ip] = self.Ping(ip, int(port))
threads, deadline = [], time.time() + 5
for ip in ips:
threads.append(threading.Thread(target=iping, args=(ip,)))
threads[-1].daemon = True
threads[-1].start()
for t in threads:
t.join(max(0.1, deadline - time.time()))
except Exception, e:
logging.LogDebug('Unreachable: %s, %s' % (domain, e))
# Evaluate ping results, mark fastest N servers as preferred
pings = [list(ping) + [ip] for ip, ping in pinged.iteritems()]
while count > 0 and pings:
mIdx = pings.index(min(pings))
if pings[mIdx][0] > 60:
# This is worthless data, abort.
break
else:
count -= 1
ptime, uuid, ip = pings[mIdx]
server = '%s:%s' % (ip, port)
if uuid not in servers_all:
servers_all[uuid] = server
if uuid not in servers_pref:
servers_pref[uuid] = server
del pings[mIdx]
nvr = self.servers_never
self.servers = [v for v in servers_all.values() if v not in nvr]
self.servers_preferred = [v for v in servers_pref.values() if v not in nvr]
logging.LogDebug('Preferred: %s' % ', '.join(self.servers_preferred))
def ConnectFrontend(self, conns, server):
self.ui.Status('connect', color=self.ui.YELLOW,
message='Front-end connect: %s' % server)
tun = Tunnel.BackEnd(server, self.backends, self.require_all, conns)
if tun:
tun.filters.append(HttpHeaderFilter(self.ui))
if not self.insecure:
tun.filters.append(HttpSecurityFilter(self.ui))
if self.watch_level[0] is not None:
tun.filters.append(TunnelWatcher(self.ui, self.watch_level))
logging.Log([('connect', server)])
return True
else:
logging.LogInfo('Failed to connect', [('FE', server)])
self.ui.Notify('Failed to connect to %s' % server,
prefix='!', color=self.ui.YELLOW)
for line in logging.LOG[-5:]:
if 'err' in line and 'ssl' in line['err'].lower():
self.ui.Notify('Unable to verify SSL certificates!')
self.ui.Notify(socks.HAVE_PYOPENSSL and
' - Using pyOpenSSL wrapper, good.' or
' - Using standard Python ssl: try installing pyOpenSSL?')
self.ui.Notify(' - CA certificates loaded: %s' % self.ca_certs)
for dom in self.fe_certname:
self.ui.Notify(' - Would accept a certificate for: %s' % dom)
self.ui.Notify(' - Check your system clock (dates matter)')
self.ui.Notify(
' - Beware firewalls that intercept outgoing SSL/TLS connections!')
self.ui.Notify(
' - Danger Zone: use --fe_nocertcheck to connect insecurely.')
# Dammit, if we know what the problem is, just fix it.
if (self.ca_certs != self.pyfile
and 'b5p.us' in (self.servers_auto or ['', ''])[1]):
logging.LogInfo('Reconfiguring', [('ca_certs', self.pyfile)])
self.ui.Notify('Reconfiguring to use internal CA certificates',
prefix="!", color=self.ui.RED)
self.ca_certs = self.pyfile
socks.setdefaultcertfile(self.ca_certs)
return False
def DisconnectFrontend(self, conns, server):
logging.Log([('disconnect', server)])
kill = []
for bid in conns.tunnels:
for tunnel in conns.tunnels[bid]:
if (server == tunnel.server_info[tunnel.S_NAME] and
tunnel.countas.startswith('frontend')):
kill.append(tunnel)
for tunnel in kill:
if len(tunnel.users.keys()) < 1:
tunnel.Die()
return kill and True or False
def CreateTunnels(self, conns):
live_servers = conns.TunnelServers()
failures = 0
connections = 0
if len(self.GetActiveBackends(include_loopback=True)) > 0:
if (not self.servers) or len(self.servers) > len(live_servers):
self.ChooseFrontEnds()
elif self.last_frontend_choice < time.time()-FE_PING_INTERVAL:
self.servers = []
self.ChooseFrontEnds(periodic=True)
else:
self.servers_preferred = []
self.servers = []
if not self.servers:
logging.LogDebug('Not sure which servers to contact, making no changes.')
return 0, 0
threads, deadline = [], time.time() + 120
def connect_in_thread(conns, server, state):
try:
state[1] = self.ConnectFrontend(conns, server)
except (IOError, OSError):
state[1] = False
for server in self.servers:
if server not in live_servers:
if server == LOOPBACK_FE:
loop = LoopbackTunnel.Loop(conns, self.backends)
loop.filters.append(HttpHeaderFilter(self.ui))
if not self.insecure:
loop.filters.append(HttpSecurityFilter(self.ui))
elif server not in self.servers_never:
state = [None, None]
state[0] = threading.Thread(target=connect_in_thread,
args=(conns, server, state))
state[0].daemon = True
state[0].start()
threads.append(state)
for thread, result in threads:
thread.join(max(0.1, deadline - time.time()))
for thread, result in threads:
# This will treat timeouts both as connections AND failures
if result is not False:
connections += 1
if result is not True:
failures += 1
for server in live_servers:
if (server not in self.servers and
server not in self.servers_preferred):
if self.DisconnectFrontend(conns, server):
connections += 1
if self.dyndns:
ddns_fmt, ddns_args = self.dyndns
domains = {}
for bid in self.backends.keys():
proto, domain = bid.split(':')
if domain not in domains:
domains[domain] = (self.backends[bid][BE_SECRET], [])
if bid in conns.tunnels:
ips, bips = [], []
for tunnel in conns.tunnels[bid]:
srv = tunnel.server_info[tunnel.S_NAME]
ip = rsplit(':', srv)[0]
if not ip == LOOPBACK_HN and not tunnel.read_eof:
if (not self.servers_preferred) or srv in self.servers_preferred:
ips.append(ip)
else:
bips.append(ip)
for ip in (ips or bips):
if ip not in domains[domain]:
domains[domain][1].append(ip)
updates = {}
for domain, (secret, ips) in domains.iteritems():
if ips:
iplist = ','.join(ips)
payload = '%s:%s' % (domain, iplist)
args = {}
args.update(ddns_args)
args.update({
'domain': domain,
'ip': ips[0],
'ips': iplist,
'sign': signToken(secret=secret, payload=payload, length=100)
})
# Note: This may be wrong if different front-ends support different
# protocols. Unfortunately, that isn't easily solvable.
updates[payload] = ddns_fmt % args
last_updates = self.last_updates
self.last_updates = []
for update in updates:
if update in last_updates:
# Was successful last time, no point in doing it again.
self.last_updates.append(update)
else:
domain, ips = update.split(':', 1)
try:
self.ui.Status('dyndns', color=self.ui.YELLOW,
message='Updating DNS for %s...' % domain)
# FIXME: If the network misbehaves, can this stall forever?
result = ''.join(urllib.urlopen(updates[update]).readlines())
if result.startswith('good') or result.startswith('nochg'):
logging.Log([('dyndns', result), ('data', update)])
self.SetBackendStatus(update.split(':')[0],
sub=BE_STATUS_ERR_DNS)
self.last_updates.append(update)
# Success! Make sure we remember these IP were live.
if domain not in self.dns_cache:
self.dns_cache[domain] = {}
self.dns_cache[domain][int(time.time())] = ips.split(',')
else:
logging.LogInfo('DynDNS update failed: %s' % result, [('data', update)])
self.SetBackendStatus(update.split(':')[0],
add=BE_STATUS_ERR_DNS)
failures += 1
except Exception, e:
logging.LogInfo('DynDNS update failed: %s' % e, [('data', update)])
if logging.DEBUG_IO: traceback.print_exc(file=sys.stderr)
self.SetBackendStatus(update.split(':')[0],
add=BE_STATUS_ERR_DNS)
# Hmm, the update may have succeeded - assume the "worst".
if domain not in self.dns_cache:
self.dns_cache[domain] = {}
self.dns_cache[domain][int(time.time())] = ips.split(',')
failures += 1
return failures, connections
def LogTo(self, filename, close_all=True, dont_close=[]):
if filename == 'memory':
logging.Log = logging.LogToMemory
filename = self.devnull
elif filename == 'syslog':
logging.Log = logging.LogSyslog
filename = self.devnull
compat.syslog.openlog(self.progname, syslog.LOG_PID, syslog.LOG_DAEMON)
else:
logging.Log = logging.LogToFile
if filename in ('stdio', 'stdout'):
try:
logging.LogFile = os.fdopen(sys.stdout.fileno(), 'w', 0)
except:
logging.LogFile = sys.stdout
else:
try:
logging.LogFile = fd = open(filename, "a", 0)
os.dup2(fd.fileno(), sys.stdout.fileno())
if not self.ui.WANTS_STDERR:
os.dup2(fd.fileno(), sys.stdin.fileno())
os.dup2(fd.fileno(), sys.stderr.fileno())
except Exception, e:
raise ConfigError('%s' % e)
def Daemonize(self):
# Fork once...
if os.fork() != 0: os._exit(0)
# Fork twice...
os.setsid()
if os.fork() != 0: os._exit(0)
def ProcessWritable(self, oready):
if logging.DEBUG_IO:
print '\n=== Ready for Write: %s' % [o and o.fileno() or ''
for o in oready]
for osock in oready:
if osock:
conn = self.conns.Connection(osock)
if conn and not conn.Send([], try_flush=True):
conn.Die(discard_buffer=True)
def ProcessReadable(self, iready, throttle):
if logging.DEBUG_IO:
print '\n=== Ready for Read: %s' % [i and i.fileno() or None
for i in iready]
for isock in iready:
if isock is not None:
conn = self.conns.Connection(isock)
if conn and not (conn.fd and conn.ReadData(maxread=throttle)):
conn.Die(discard_buffer=True)
def ProcessDead(self, epoll=None):
for conn in self.conns.DeadConns():
if epoll and conn.fd:
try:
epoll.unregister(conn.fd)
except (IOError, TypeError):
pass
conn.Cleanup()
self.conns.Remove(conn)
def Select(self, epoll, waittime):
iready = oready = eready = None
isocks, osocks = self.conns.Readable(), self.conns.Blocked()
try:
if isocks or osocks:
iready, oready, eready = select.select(isocks, osocks, [], waittime)
else:
# Windoes does not seem to like empty selects, so we do this instead.
time.sleep(waittime/2)
except KeyboardInterrupt:
raise
except:
logging.LogError('Error in select(%s/%s): %s' % (isocks, osocks,
format_exc()))
self.conns.CleanFds()
self.last_loop -= 1
now = time.time()
if not iready and not oready:
if (isocks or osocks) and (now < self.last_loop + 1):
logging.LogError('Spinning, pausing ...')
time.sleep(0.1)
return None, iready, oready, eready
def Epoll(self, epoll, waittime):
fdc = {}
now = time.time()
evs = []
broken = False
try:
bbc = 0
for c in self.conns.conns:
fd, mask = c.fd, 0
if not c.IsDead():
if c.IsBlocked():
bbc += len(c.write_blocked)
mask |= select.EPOLLOUT
if c.IsReadable(now):
mask |= select.EPOLLIN
if mask:
try:
fdc[fd.fileno()] = fd
except socket.error:
# If this fails, then the socket has HUPed, however we need to
# bypass epoll to make sure that's reflected in iready below.
bid = 'dead-%d' % len(evs)
fdc[bid] = fd
evs.append((bid, select.EPOLLHUP))
# Trigger removal of c.fd, if it was still in the epoll.
fd, mask = None, 0
if mask:
try:
epoll.modify(fd, mask)
except IOError:
try:
epoll.register(fd, mask)
except (IOError, TypeError):
evs.append((fd, select.EPOLLHUP)) # Error == HUP
else:
try:
epoll.unregister(c.fd) # Important: Use c.fd, not fd!
except (IOError, TypeError):
# Failing to unregister is OK, ignore
pass
common.buffered_bytes[0] = bbc
evs.extend(epoll.poll(waittime))
except (IOError, OSError):
broken = 'in poll'
except KeyboardInterrupt:
epoll.close()
raise
rmask = select.EPOLLIN | select.EPOLLHUP
iready = [fdc.get(e[0]) for e in evs if e[1] & rmask]
oready = [fdc.get(e[0]) for e in evs if e[1] & select.EPOLLOUT]
if not broken and ((None in iready) or (None in oready)):
broken = 'unknown FDs'
if broken:
logging.LogError('Epoll appears to be broken (%s), recreating' % broken)
try:
epoll.close()
except (IOError, OSError, TypeError, AttributeError):
pass
epoll = select.epoll()
return epoll, iready, oready, []
def CreatePollObject(self):
try:
epoll = select.epoll()
mypoll = self.Epoll
except:
epoll = None
mypoll = self.Select
return epoll, mypoll
def Loop(self):
self.conns.start(auth_thread_count=self.auth_threads)
if self.ui_httpd: self.ui_httpd.start()
if self.tunnel_manager: self.tunnel_manager.start()
if self.ui_comm: self.ui_comm.start()
epoll, mypoll = self.CreatePollObject()
self.last_barf = self.last_loop = time.time()
logging.LogDebug('Entering main %s loop' % (epoll and 'epoll' or 'select'))
loop_count = 0
while self.keep_looping:
epoll, iready, oready, eready = mypoll(epoll, 1.1)
now = time.time()
if oready:
self.ProcessWritable(oready)
if common.buffered_bytes[0] < 1024 * self.buffer_max:
throttle = None
else:
logging.LogDebug("FIXME: Nasty pause to let buffers clear!")
time.sleep(0.1)
throttle = 1024
if iready:
self.ProcessReadable(iready, throttle)
self.ProcessDead(epoll)
self.last_loop = now
loop_count += 1
if now - self.last_barf > (logging.DEBUG_IO and 15 or 600):
self.last_barf = now
if epoll:
epoll.close()
epoll, mypoll = self.CreatePollObject()
logging.LogDebug('Loop #%d, selectable map: %s' % (loop_count, SELECTABLES))
if epoll:
epoll.close()
def Start(self, howtoquit='CTRL+C = Stop'):
conns = self.conns = self.conns or Connections(self)
# If we are going to spam stdout with ugly crap, then there is no point
# attempting the fancy stuff. This also makes us backwards compatible
# for the most part.
if self.logfile == 'stdio':
if not self.ui.DAEMON_FRIENDLY: self.ui = NullUi()
# Announce that we've started up!
self.ui.Status('startup', message='Starting up...')
self.ui.Notify(('Hello! This is %s v%s.'
) % (self.progname, APPVER),
prefix='>', color=self.ui.GREEN,
alignright='[%s]' % howtoquit)
config_report = [('started', self.pyfile), ('version', APPVER),
('platform', sys.platform),
('argv', ' '.join(sys.argv[1:])),
('ca_certs', self.ca_certs)]
for optf in self.rcfiles_loaded:
config_report.append(('optfile_%s' % optf, 'ok'))
logging.Log(config_report)
if not socks.HAVE_SSL:
self.ui.Notify('SECURITY WARNING: No SSL support was found, tunnels are insecure!',
prefix='!', color=self.ui.WHITE)
self.ui.Notify('Please install either pyOpenSSL or python-ssl.',
prefix='!', color=self.ui.WHITE)
# Create global secret
self.ui.Status('startup', message='Collecting entropy for a secure secret...')
logging.LogInfo('Collecting entropy for a secure secret.')
globalSecret()
self.ui.Status('startup', message='Starting up...')
# Create the UI Communicator
self.ui_comm = UiCommunicator(self, conns)
try:
# Set up our listeners if we are a server.
if self.isfrontend:
self.ui.Notify('This is a PageKite front-end server.')
for port in self.server_ports:
Listener(self.server_host, port, conns, acl=self.accept_acl_file)
for port in self.server_raw_ports:
if port != VIRTUAL_PN and port > 0:
Listener(self.server_host, port, conns,
connclass=RawConn, acl=self.accept_acl_file)
if self.ui_port:
Listener('127.0.0.1', self.ui_port, conns,
connclass=UiConn, acl=self.accept_acl_file)
# Create the Tunnel Manager
self.tunnel_manager = TunnelManager(self, conns)
except Exception, e:
self.LogTo('stdio')
logging.FlushLogMemory()
if logging.DEBUG_IO:
traceback.print_exc(file=sys.stderr)
raise ConfigError('Configuring listeners: %s ' % e)
# Configure logging
if self.logfile:
keep_open = [s.fd.fileno() for s in conns.conns]
if self.ui_httpd: keep_open.append(self.ui_httpd.httpd.socket.fileno())
self.LogTo(self.logfile, dont_close=keep_open)
elif not (hasattr(sys.stdout, 'isatty') and sys.stdout.isatty()):
# Preserve sane behavior when not run at the console.
self.LogTo('stdio')
# Flush in-memory log, if necessary
logging.FlushLogMemory()
# Set up SIGHUP handler.
if self.logfile:
try:
import signal
def reopen(x,y):
if self.logfile:
self.LogTo(self.logfile, close_all=False)
logging.LogDebug('SIGHUP received, reopening: %s' % self.logfile)
signal.signal(signal.SIGHUP, reopen)
except Exception:
logging.LogError('Warning: signal handler unavailable, logrotate will not work.')
# Disable compression in OpenSSL
if socks.HAVE_SSL and not self.enable_sslzlib:
socks.DisableSSLCompression()
# Daemonize!
if self.daemonize:
self.Daemonize()
# Create PID file
if self.pidfile:
pf = open(self.pidfile, 'w')
pf.write('%s\n' % os.getpid())
pf.close()
# Do this after creating the PID and log-files.
if self.daemonize:
os.chdir('/')
# Drop privileges, if we have any.
if self.setgid:
os.setgid(self.setgid)
if self.setuid:
os.setuid(self.setuid)
if self.setuid or self.setgid:
logging.Log([('uid', os.getuid()), ('gid', os.getgid())])
# Make sure we have what we need
if self.require_all:
self.CreateTunnels(conns)
self.CheckAllTunnels(conns)
# Finally, run our select loop.
self.Loop()
self.ui.Status('exiting', message='Stopping...')
logging.Log([('stopping', 'pagekite.py')])
if self.ui_httpd:
self.ui_httpd.quit()
if self.ui_comm:
self.ui_comm.quit()
if self.tunnel_manager:
self.tunnel_manager.quit()
if self.conns:
if self.conns.auth_pool:
for th in self.conns.auth_pool:
th.quit()
for conn in self.conns.conns:
conn.Cleanup()
##[ Main ]#####################################################################
def Main(pagekite, configure, uiclass=NullUi,
progname=None, appver=APPVER,
http_handler=None, http_server=None):
crashes = 0
shell_mode = None
while True:
ui = uiclass()
logging.ResetLog()
pk = pagekite(ui=ui, http_handler=http_handler, http_server=http_server)
try:
try:
try:
configure(pk)
except SystemExit, status:
sys.exit(status)
except Exception, e:
if logging.DEBUG_IO:
raise
raise ConfigError(e)
shell_mode = shell_mode or pk.shell
if shell_mode is not True:
pk.Start()
except (ConfigError, getopt.GetoptError), msg:
pk.FallDown(msg, help=(not shell_mode), noexit=shell_mode)
if shell_mode:
shell_mode = 'more'
except KeyboardInterrupt, msg:
pk.FallDown(None, help=False, noexit=True)
if shell_mode:
shell_mode = 'auto'
else:
return
except SystemExit, status:
if shell_mode:
shell_mode = 'more'
else:
sys.exit(status)
except Exception, msg:
traceback.print_exc(file=sys.stderr)
if pk.crash_report_url:
try:
print 'Submitting crash report to %s' % pk.crash_report_url
logging.LogDebug(''.join(urllib.urlopen(pk.crash_report_url,
urllib.urlencode({
'platform': sys.platform,
'appver': APPVER,
'crash': format_exc()
})).readlines()))
except Exception, e:
print 'FAILED: %s' % e
pk.FallDown(msg, help=False, noexit=pk.main_loop)
crashes = min(9, crashes+1)
if shell_mode:
crashes = 0
try:
sys.argv[1:] = Shell(pk, ui, shell_mode)
shell_mode = 'more'
except (KeyboardInterrupt, IOError, OSError):
ui.Status('quitting')
print
return
elif not pk.main_loop:
return
# Exponential fall-back.
logging.LogDebug('Restarting in %d seconds...' % (2 ** crashes))
time.sleep(2 ** crashes)
def Shell(pk, ui, shell_mode):
import manual
try:
ui.Reset()
if shell_mode != 'more':
ui.StartWizard('The PageKite Shell')
pre = [
'Press ENTER to fly your kites or CTRL+C to quit. Or, type some',
'arguments to and try other things. Type `help` for help.'
]
else:
pre = ''
prompt = os.path.basename(sys.argv[0])
while True:
rv = ui.AskQuestion(prompt, prompt=' $', back=False, pre=pre
).strip().split()
ui.EndWizard(quietly=True)
while rv and rv[0] in ('pagekite.py', prompt):
rv.pop(0)
if rv and rv[0] == 'help':
ui.welcome = '>>> ' + ui.WHITE + ' '.join(rv) + ui.NORM
ui.Tell(manual.HELP(rv[1:]).splitlines())
pre = []
elif rv and rv[0] == 'quit':
raise KeyboardInterrupt()
else:
if rv and rv[0] in OPT_ARGS:
rv[0] = '--'+rv[0]
return rv
finally:
ui.EndWizard(quietly=True)
print
def Configure(pk):
if '--appver' in sys.argv:
print '%s' % APPVER
sys.exit(0)
if '--clean' not in sys.argv and '--help' not in sys.argv:
if os.path.exists(pk.rcfile):
pk.ConfigureFromFile()
friendly_mode = (('--friendly' in sys.argv) or
(sys.platform[:3] in ('win', 'os2', 'dar')))
if friendly_mode and hasattr(sys.stdout, 'isatty') and sys.stdout.isatty():
pk.shell = (len(sys.argv) < 2) and 'auto'
pk.Configure(sys.argv[1:])
if '--settings' in sys.argv:
pk.PrintSettings(safe=True)
sys.exit(0)
if not pk.backends.keys() and (not pk.kitesecret or not pk.kitename):
if '--signup' in sys.argv or friendly_mode:
pk.RegisterNewKite(autoconfigure=True, first=True)
if friendly_mode:
pk.save = True
pk.CheckConfig()
if pk.added_kites:
if (pk.save or
pk.ui.AskYesNo('Save settings to %s?' % pk.rcfile,
default=(len(pk.backends.keys()) > 0))):
pk.SaveUserConfig()
pk.servers_new_only = 'Once'
elif pk.save:
pk.SaveUserConfig(quiet=True)
if ('--list' in sys.argv or
pk.kite_add or pk.kite_remove or pk.kite_only or pk.kite_disable):
pk.ListKites()
sys.exit(0)
pagekite-0.5.9.3/pagekite/proto/ 0000755 0000000 0000000 00000000000 13232067643 016357 5 ustar root root 0000000 0000000 pagekite-0.5.9.3/pagekite/proto/proto.py 0000755 0000000 0000000 00000026627 13232067545 020115 0 ustar root root 0000000 0000000 """
PageKite protocol and HTTP protocol related code and constants.
"""
##############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
##############################################################################
import base64
import os
import random
import struct
import time
from pagekite.compat import *
from pagekite.common import *
import pagekite.logging as logging
gSecret = None
def globalSecret():
global gSecret
if not gSecret:
# This always works...
gSecret = '%8.8x%s%8.8x' % (random.randint(0, 0x7FFFFFFE),
time.time(),
random.randint(0, 0x7FFFFFFE))
# Next, see if we can augment that with some real randomness.
try:
newSecret = sha1hex(open('/dev/urandom').read(64) + gSecret)
gSecret = newSecret
logging.LogDebug('Seeded signatures using /dev/urandom, hooray!')
except:
try:
newSecret = sha1hex(os.urandom(64) + gSecret)
gSecret = newSecret
logging.LogDebug('Seeded signatures using os.urandom(), hooray!')
except:
logging.LogInfo('WARNING: Seeding signatures with time.time() and random.randint()')
return gSecret
TOKEN_LENGTH=36
def signToken(token=None, secret=None, payload='', timestamp=None,
length=TOKEN_LENGTH):
"""
This will generate a random token with a signature which could only have come
from this server. If a token is provided, it is re-signed so the original
can be compared with what we would have generated, for verification purposes.
If a timestamp is provided it will be embedded in the signature to a
resolution of 10 minutes, and the signature will begin with the letter 't'
Note: This is only as secure as random.randint() is random.
"""
if not secret: secret = globalSecret()
if not token: token = sha1hex('%s%8.8x' % (globalSecret(),
random.randint(0, 0x7FFFFFFD)+1))
if timestamp:
tok = 't' + token[1:]
ts = '%x' % int(timestamp/600)
return tok[0:8] + sha1hex(secret + payload + ts + tok[0:8])[0:length-8]
else:
return token[0:8] + sha1hex(secret + payload + token[0:8])[0:length-8]
def checkSignature(sign='', secret='', payload=''):
"""
Check a signature for validity. When using timestamped signatures, we only
accept signatures from the current and previous windows.
"""
if sign[0] == 't':
ts = int(time.time())
for window in (0, 1):
valid = signToken(token=sign, secret=secret, payload=payload,
timestamp=(ts-(window*600)))
if sign == valid: return True
return False
else:
valid = signToken(token=sign, secret=secret, payload=payload)
return sign == valid
def PageKiteRequestHeaders(server, backends, tokens=None, testtoken=None):
req = []
tokens = tokens or {}
for d in backends.keys():
if (backends[d][BE_BHOST] and
backends[d][BE_SECRET] and
backends[d][BE_STATUS] not in BE_INACTIVE):
# A stable (for replay on challenge) but unguessable salt.
my_token = sha1hex(globalSecret() + server + backends[d][BE_SECRET]
)[:TOKEN_LENGTH]
# This is the challenge (salt) from the front-end, if any.
server_token = d in tokens and tokens[d] or ''
# Our payload is the (proto, name) combined with both salts
data = '%s:%s:%s' % (d, my_token, server_token)
# Sign the payload with the shared secret (random salt).
sign = signToken(secret=backends[d][BE_SECRET],
payload=data,
token=testtoken)
req.append('X-PageKite: %s:%s\r\n' % (data, sign))
return req
def HTTP_PageKiteRequest(server, backends, tokens=None, nozchunks=False,
tls=False, testtoken=None, replace=None):
req = ['CONNECT PageKite:1 HTTP/1.0\r\n',
'X-PageKite-Features: AddKites\r\n',
'X-PageKite-Version: %s\r\n' % APPVER]
if not nozchunks:
req.append('X-PageKite-Features: ZChunks\r\n')
if replace:
req.append('X-PageKite-Replace: %s\r\n' % replace)
if tls:
req.append('X-PageKite-Features: TLS\r\n')
req.extend(PageKiteRequestHeaders(server, backends,
tokens=tokens, testtoken=testtoken))
req.append('\r\n')
return ''.join(req)
def HTTP_ResponseHeader(code, title, mimetype='text/html', first_headers=None):
if mimetype.startswith('text/') and ';' not in mimetype:
mimetype += ('; charset=%s' % DEFAULT_CHARSET)
return ('HTTP/1.1 %s %s\r\n%sContent-Type: %s\r\nPragma: no-cache\r\n'
'Expires: 0\r\nCache-Control: no-store\r\nConnection: close'
'\r\n') % (code, title, ''.join(first_headers or []), mimetype)
def HTTP_Header(name, value):
return '%s: %s\r\n' % (name, value)
def HTTP_StartBody():
return '\r\n'
def HTTP_ConnectOK():
return 'HTTP/1.0 200 Connection Established\r\n\r\n'
def HTTP_ConnectBad(code=503, status='Unavailable'):
return 'HTTP/1.0 %s %s\r\n\r\n' % (code, status)
def HTTP_Response(code, title, body,
mimetype='text/html', headers=None,
trackable=False, overloaded=False):
if overloaded or trackable:
headers = headers or []
if trackable: # Put this first...
headers = [HTTP_Header('X-PageKite-UUID', MAGIC_UUID)] + headers
if overloaded: # No, put this first!
headers = [HTTP_Header('X-PageKite-Overloaded', 'Sorry')] + headers
return ''.join([
HTTP_ResponseHeader(code, title, mimetype, first_headers=headers),
HTTP_StartBody(),
''.join(body)])
def HTTP_NoFeConnection(proto):
if proto.endswith('.json'):
(mt, content) = ('application/json', '{"pagekite-status": "down-fe"}')
else:
(mt, content) = ('image/gif', base64.decodestring(
'R0lGODlhCgAKAMQCAN4hIf/+/v///+EzM+AuLvGkpORISPW+vudgYOhiYvKpqeZY'
'WPbAwOdaWup1dfOurvW7u++Rkepycu6PjwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAACH5BAEAAAIALAAAAAAKAAoAAAUtoCAcyEA0jyhEQOs6AuPO'
'QJHQrjEAQe+3O98PcMMBDAdjTTDBSVSQEmGhEIUAADs='))
return HTTP_Response(200, 'OK', content, mimetype=mt,
headers=[HTTP_Header('X-PageKite-Status', 'Down-FE'),
HTTP_Header('Access-Control-Allow-Origin', '*')])
def HTTP_NoBeConnection(proto):
if proto.endswith('.json'):
(mt, content) = ('application/json', '{"pagekite-status": "down-be"}')
else:
(mt, content) = ('image/gif', base64.decodestring(
'R0lGODlhCgAKAPcAAI9hE6t2Fv/GAf/NH//RMf/hd7u6uv/mj/ntq8XExMbFxc7N'
'zc/Ozv/xwfj31+jn5+vq6v///////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAACH5BAEAABIALAAAAAAKAAoAAAhDACUIlBAgwMCDARo4MHiQ'
'4IEGDAcGKAAAAESEBCoiiBhgQEYABzYK7OiRQIEDBgMIEDCgokmUKlcOKFkgZcGb'
'BSUEBAA7'))
return HTTP_Response(200, 'OK', content, mimetype=mt,
headers=[HTTP_Header('X-PageKite-Status', 'Down-BE'),
HTTP_Header('Access-Control-Allow-Origin', '*')])
def HTTP_GoodBeConnection(proto):
if proto.endswith('.json'):
(mt, content) = ('application/json', '{"pagekite-status": "ok"}')
else:
(mt, content) = ('image/gif', base64.decodestring(
'R0lGODlhCgAKANUCAEKtP0StQf8AAG2/a97w3qbYpd/x3mu/aajZp/b79vT69Mnn'
'yK7crXTDcqraqcfmxtLr0VG0T0ivRpbRlF24Wr7jveHy4Pv9+53UnPn8+cjnx4LI'
'gNfu1v///37HfKfZpq/crmG6XgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
'AAAAAAAAAAAAAAAAACH5BAEAAAIALAAAAAAKAAoAAAZIQIGAUDgMEASh4BEANAGA'
'xRAaaHoYAAPCCZUoOIDPAdCAQhIRgJGiAG0uE+igAMB0MhYoAFmtJEJcBgILVU8B'
'GkpEAwMOggJBADs='))
return HTTP_Response(200, 'OK', content, mimetype=mt,
headers=[HTTP_Header('X-PageKite-Status', 'OK'),
HTTP_Header('Access-Control-Allow-Origin', '*')])
def HTTP_Unavailable(where, proto, domain, comment='', frame_url=None,
code=503, status='Unavailable', headers=None,
overloaded=False, advertise=True, relay_sockname=None):
if advertise:
label = "PageKite"
whatis = ''.join(['', label, ''])
else:
label = "Connection"
whatis = "connection"
if code == 401:
headers = headers or []
headers.append(HTTP_Header('WWW-Authenticate', 'Basic realm=%s' % label))
message = ''.join(['
Sorry! (', where, ')
',
'
The ', proto.upper(), ' ', whatis, ' for ',
domain, ' is unavailable at the moment.
',
'
Please try again later.
'])
if frame_url:
if '?' in frame_url:
frame_url += ('&where=%s&proto=%s&domain=%s'
% (where.upper(), proto, domain))
if relay_sockname is not None:
frame_url += ('&relay=%s' % relay_sockname[0])
return HTTP_Response(code, status,
['\n'],
headers=headers,
trackable=True, overloaded=overloaded)
else:
return HTTP_Response(code, status,
['', message, '\n'],
headers=headers,
trackable=True, overloaded=overloaded)
def TLS_Unavailable(forbidden=False, unavailable=False):
"""Generate a TLS alert record aborting this connectin."""
# FIXME: Should we really be ignoring forbidden and unavailable?
# Unfortunately, Chrome/ium only honors code 49, any other code will
# cause it to transparently retry with SSLv3. So although this is a
# bit misleading, this is what we send...
return struct.pack('>BBBBBBB', 0x15, 3, 3, 0, 2, 2, 49) # 49 = Access denied
pagekite-0.5.9.3/pagekite/proto/filters.py 0000755 0000000 0000000 00000016035 13232067545 020412 0 ustar root root 0000000 0000000 """
These are filters placed at the end of a tunnel for watching or modifying
the traffic.
"""
##############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
##############################################################################
import re
import time
from pagekite.compat import *
class TunnelFilter:
"""Base class for watchers/filters for data going in/out of Tunnels."""
IDLE_TIMEOUT = 1800
def __init__(self, ui):
self.sid = {}
self.ui = ui
def clean_idle_sids(self, now=None):
now = now or time.time()
for sid in self.sid.keys():
if self.sid[sid]['_ts'] < now - self.IDLE_TIMEOUT:
del self.sid[sid]
def filter_set_sid(self, sid, info):
now = time.time()
if sid not in self.sid:
self.sid[sid] = {}
self.sid[sid].update(info)
self.sid[sid]['_ts'] = now
self.clean_idle_sids(now=now)
def filter_data_in(self, tunnel, sid, data):
if sid not in self.sid:
self.sid[sid] = {}
self.sid[sid]['_ts'] = time.time()
return data
def filter_data_out(self, tunnel, sid, data):
if sid not in self.sid:
self.sid[sid] = {}
self.sid[sid]['_ts'] = time.time()
return data
class TunnelWatcher(TunnelFilter):
"""Base class for watchers/filters for data going in/out of Tunnels."""
def __init__(self, ui, watch_level=0):
TunnelFilter.__init__(self, ui)
self.watch_level = watch_level
def format_data(self, data, level):
if '\r\n\r\n' in data:
head, tail = data.split('\r\n\r\n', 1)
output = self.format_data(head, level)
output[-1] += '\\r\\n'
output.append('\\r\\n')
if tail:
output.extend(self.format_data(tail, level))
return output
else:
output = data.encode('string_escape').replace('\\n', '\\n\n')
if output.count('\\') > 0.15*len(output):
if level > 2:
output = [['', '']]
count = 0
for d in data:
output[-1][0] += '%2.2x' % ord(d)
output[-1][1] += '%c' % ((ord(d) > 31 and ord(d) < 127) and d or '.')
count += 1
if (count % 2) == 0:
output[-1][0] += ' '
if (count % 20) == 0:
output.append(['', ''])
return ['%-50s %s' % (l[0], l[1]) for l in output]
else:
return ['<< Binary bytes: %d >>' % len(data)]
else:
return output.strip().splitlines()
def now(self):
return ts_to_iso(int(10*time.time())/10.0
).replace('T', ' ').replace('00000', '')
def filter_data_in(self, tunnel, sid, data):
if data and self.watch_level[0] > 0:
self.ui.Notify('===[ INCOMING @ %s ]===' % self.now(),
color=self.ui.WHITE, prefix=' __')
for line in self.format_data(data, self.watch_level[0]):
self.ui.Notify(line, prefix=' <=', now=-1, color=self.ui.GREEN)
return TunnelFilter.filter_data_in(self, tunnel, sid, data)
def filter_data_out(self, tunnel, sid, data):
if data and self.watch_level[0] > 1:
self.ui.Notify('===[ OUTGOING @ %s ]===' % self.now(),
color=self.ui.WHITE, prefix=' __')
for line in self.format_data(data, self.watch_level[0]):
self.ui.Notify(line, prefix=' =>', now=-1, color=self.ui.BLUE)
return TunnelFilter.filter_data_out(self, tunnel, sid, data)
class HttpHeaderFilter(TunnelFilter):
"""Filter that adds X-Forwarded-For and X-Forwarded-Proto to requests."""
HTTP_HEADER = re.compile('(?ism)^(([A-Z]+) ([^\n]+) HTTP/\d+\.\d+\s*)$')
DISABLE = 'rawheaders'
def filter_data_in(self, tunnel, sid, data):
info = self.sid.get(sid)
if (info and
info.get('proto') in ('http', 'http2', 'http3', 'websocket') and
not info.get(self.DISABLE, False)):
# FIXME: Check content-length and skip bodies entirely
http_hdr = self.HTTP_HEADER.search(data)
if http_hdr:
data = self.filter_header_data_in(http_hdr, data, info)
return TunnelFilter.filter_data_in(self, tunnel, sid, data)
def filter_header_data_in(self, http_hdr, data, info):
clean_headers = [
r'(?mi)^(X-(PageKite|Forwarded)-(For|Proto|Port):)'
]
add_headers = [
'X-Forwarded-For: %s' % info.get('remote_ip', 'unknown'),
'X-Forwarded-Proto: %s' % (info.get('using_tls') and 'https' or 'http'),
'X-PageKite-Port: %s' % info.get('port', 0)
]
if info.get('rewritehost', False):
add_headers.append('Host: %s' % info.get('rewritehost'))
clean_headers.append(r'(?mi)^(Host:)')
if http_hdr.group(1).upper() in ('POST', 'PUT'):
# FIXME: This is a bit ugly
add_headers.append('Connection: close')
clean_headers.append(r'(?mi)^(Connection|Keep-Alive):')
info['rawheaders'] = True
for hdr_re in clean_headers:
data = re.sub(hdr_re, 'X-Old-\\1', data)
return re.sub(self.HTTP_HEADER,
'\\1\n%s\r' % '\r\n'.join(add_headers),
data)
class HttpSecurityFilter(HttpHeaderFilter):
"""Filter that blocks known-to-be-dangerous requests."""
DISABLE = 'trusted'
HTTP_DANGER = re.compile('(?ism)^((get|post|put|patch|delete) '
# xampp paths, anything starting with /adm*
'((?:/+(?:xampp/|security/|licenses/|webalizer/|server-(?:status|info)|adm)'
'|[^\n]*/'
# WordPress admin pages
'(?:wp-admin/(?!admin-ajax|css/)|wp-config\.php'
# Hackzor tricks
'|system32/|\.\.|\.ht(?:access|pass)'
# phpMyAdmin and similar tools
'|(?:php|sql)?my(?:sql)?(?:adm|manager)'
# Setup pages for common PHP tools
'|(?:adm[^\n]*|install[^\n]*|setup)\.php)'
')[^\n]*)'
' HTTP/\d+\.\d+\s*)$')
REJECT = 'PAGEKITE_REJECT_'
def filter_header_data_in(self, http_hdr, data, info):
danger = self.HTTP_DANGER.search(data)
if danger:
self.ui.Notify('BLOCKED: %s %s' % (danger.group(2), danger.group(3)),
color=self.ui.RED, prefix='***')
self.ui.Notify('See https://pagekite.net/support/security/ for more'
' details.')
return self.REJECT+data
else:
return data
pagekite-0.5.9.3/pagekite/proto/parsers.py 0000755 0000000 0000000 00000017166 13232067545 020427 0 ustar root root 0000000 0000000 """
Protocol parsers for classifying incoming network connections.
"""
##############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
##############################################################################
import re
from pagekite.compat import *
from pagekite.common import *
import pagekite.logging as logging
HTTP_METHODS = ['OPTIONS', 'CONNECT', 'GET', 'HEAD', 'POST', 'PUT', 'TRACE',
'PROPFIND', 'PROPPATCH', 'MKCOL', 'DELETE', 'COPY', 'MOVE',
'LOCK', 'UNLOCK', 'PING', 'PATCH']
HTTP_VERSIONS = ['HTTP/1.0', 'HTTP/1.1']
EMBEDDED_IP_RE = re.compile(r'^0x(?:[0-9a-fA-F]{8,8}|[0-9a-fA-F]{32,32})--')
def StripEncodedIP(domain):
if domain:
return EMBEDDED_IP_RE.sub('', str(domain))
return domain
class BaseLineParser(object):
"""Base protocol parser class."""
PROTO = 'unknown'
PROTOS = ['unknown']
PARSE_UNKNOWN = -2
PARSE_FAILED = -1
PARSE_OK = 100
def __init__(self, lines=None, state=PARSE_UNKNOWN, proto=PROTO):
self.state = state
self.protocol = proto
self.lines = []
self.domain = None
self.last_parser = self
if lines is not None:
for line in lines:
if not self.Parse(line): break
def ParsedOK(self):
return (self.state == self.PARSE_OK)
def Parse(self, line):
self.lines.append(line)
return False
def ErrorReply(self, port=None):
return ''
class MagicLineParser(BaseLineParser):
"""Parse an unknown incoming connection request, line-by-line."""
PROTO = 'magic'
def __init__(self, lines=None, state=BaseLineParser.PARSE_UNKNOWN,
parsers=[]):
self.parsers = [p() for p in parsers]
BaseLineParser.__init__(self, lines, state, self.PROTO)
if self.last_parser == self:
self.last_parser = self.parsers[-1]
def ParsedOK(self):
return self.last_parser.ParsedOK()
def Parse(self, line):
BaseLineParser.Parse(self, line)
self.last_parser = self.parsers[-1]
for p in self.parsers[:]:
if not p.Parse(line):
self.parsers.remove(p)
elif p.ParsedOK():
self.last_parser = p
self.domain = p.domain
self.protocol = p.protocol
self.state = p.state
self.parsers = [p]
break
if not self.parsers:
logging.LogDebug('No more parsers!')
return (len(self.parsers) > 0)
class HttpLineParser(BaseLineParser):
"""Parse an HTTP request, line-by-line."""
PROTO = 'http'
PROTOS = ['http']
IN_REQUEST = 11
IN_HEADERS = 12
IN_BODY = 13
IN_RESPONSE = 14
def __init__(self, lines=None, state=IN_REQUEST, testbody=False):
self.method = None
self.path = None
self.version = None
self.code = None
self.message = None
self.headers = []
self.body_result = testbody
BaseLineParser.__init__(self, lines, state, self.PROTO)
def ParseResponse(self, line):
self.version, self.code, self.message = line.split()
if not self.version.upper() in HTTP_VERSIONS:
logging.LogDebug('Invalid version: %s' % self.version)
return False
self.state = self.IN_HEADERS
return True
def ParseRequest(self, line):
self.method, self.path, self.version = line.split()
if not self.method in HTTP_METHODS:
logging.LogDebug('Invalid method: %s' % self.method)
return False
if not self.version.upper() in HTTP_VERSIONS:
logging.LogDebug('Invalid version: %s' % self.version)
return False
self.state = self.IN_HEADERS
return True
def ParseHeader(self, line):
if line in ('', '\r', '\n', '\r\n'):
self.state = self.IN_BODY
return True
header, value = line.split(':', 1)
if value and value.startswith(' '): value = value[1:]
self.headers.append((header.lower(), value))
return True
def ParseBody(self, line):
# Could be overridden by subclasses, for now we just play dumb.
return self.body_result
def ParsedOK(self):
return (self.state == self.IN_BODY)
def Parse(self, line):
BaseLineParser.Parse(self, line)
try:
if (self.state == self.IN_RESPONSE):
return self.ParseResponse(line)
elif (self.state == self.IN_REQUEST):
return self.ParseRequest(line)
elif (self.state == self.IN_HEADERS):
return self.ParseHeader(line)
elif (self.state == self.IN_BODY):
return self.ParseBody(line)
except ValueError, err:
logging.LogDebug('Parse failed: %s, %s, %s' % (self.state, err, self.lines))
self.state = BaseLineParser.PARSE_FAILED
return False
def Header(self, header):
return [h[1].strip() for h in self.headers if h[0] == header.lower()]
class FingerLineParser(BaseLineParser):
"""Parse an incoming Finger request, line-by-line."""
PROTO = 'finger'
PROTOS = ['finger', 'httpfinger']
WANT_FINGER = 71
def __init__(self, lines=None, state=WANT_FINGER):
BaseLineParser.__init__(self, lines, state, self.PROTO)
def ErrorReply(self, port=None):
if port == 79:
return ('PageKite wants to know, what domain?\n'
'Try: finger user+domain@domain\n')
else:
return ''
def Parse(self, line):
BaseLineParser.Parse(self, line)
if ' ' in line: return False
if '+' in line:
arg0, self.domain = line.strip().split('+', 1)
elif '@' in line:
arg0, self.domain = line.strip().split('@', 1)
if self.domain:
self.state = BaseLineParser.PARSE_OK
self.lines[-1] = '%s\n' % arg0
return True
else:
self.state = BaseLineParser.PARSE_FAILED
return False
class IrcLineParser(BaseLineParser):
"""Parse an incoming IRC connection, line-by-line."""
PROTO = 'irc'
PROTOS = ['irc']
WANT_USER = 61
def __init__(self, lines=None, state=WANT_USER):
self.seen = []
BaseLineParser.__init__(self, lines, state, self.PROTO)
def ErrorReply(self):
return ':pagekite 451 :IRC Gateway requires user@HOST or nick@HOST\n'
def Parse(self, line):
BaseLineParser.Parse(self, line)
if line in ('\n', '\r\n'): return True
if self.state == IrcLineParser.WANT_USER:
try:
ocmd, arg = line.strip().split(' ', 1)
cmd = ocmd.lower()
self.seen.append(cmd)
args = arg.split(' ')
if cmd == 'pass':
pass
elif cmd in ('user', 'nick'):
if '@' in args[0]:
parts = args[0].split('@')
self.domain = parts[-1]
arg0 = '@'.join(parts[:-1])
elif 'nick' in self.seen and 'user' in self.seen and not self.domain:
raise Error('No domain found')
if self.domain:
self.state = BaseLineParser.PARSE_OK
self.lines[-1] = '%s %s %s\n' % (ocmd, arg0, ' '.join(args[1:]))
else:
self.state = BaseLineParser.PARSE_FAILED
except Exception, err:
logging.LogDebug('Parse failed: %s, %s, %s' % (self.state, err, self.lines))
self.state = BaseLineParser.PARSE_FAILED
return (self.state != BaseLineParser.PARSE_FAILED)
pagekite-0.5.9.3/pagekite/proto/__init__.py 0000644 0000000 0000000 00000001730 13232067545 020472 0 ustar root root 0000000 0000000 """
These are the PageKite protocol handling classes.
"""
##############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
##############################################################################
pagekite-0.5.9.3/pagekite/proto/conns.py 0000755 0000000 0000000 00000175360 13232067545 020071 0 ustar root root 0000000 0000000 """
These are the Connection classes, relatively high level classes that handle
incoming or outgoing network connections.
"""
##############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
##############################################################################
import socket
import sys
import threading
import time
import traceback
from pagekite.compat import *
from pagekite.common import *
import pagekite.common as common
import pagekite.logging as logging
from filters import HttpSecurityFilter
from selectables import *
from parsers import *
from proto import *
class Tunnel(ChunkParser):
"""A Selectable representing a PageKite tunnel."""
S_NAME = 0
S_PORTS = 1
S_RAW_PORTS = 2
S_PROTOS = 3
S_ADD_KITES = 4
S_IS_MOBILE = 5
S_VERSION = 6
def __init__(self, conns):
ChunkParser.__init__(self, ui=conns.config.ui)
self.server_info = ['x.x.x.x:x', [], [], [], False, False, None]
self.Init(conns)
# We want to be sure to read the entire chunk at once, including
# headers to save cycles, so we double the size we're willing to
# read here.
self.maxread *= 2
def Init(self, conns):
self.conns = conns
self.users = {}
self.remote_ssl = {}
self.zhistory = {}
self.backends = {}
self.last_ping = 0
self.weighted_rtt = -1
self.using_tls = False
self.filters = []
def Cleanup(self, close=True):
if self.users:
for sid in self.users.keys():
self.CloseStream(sid)
ChunkParser.Cleanup(self, close=close)
self.Init(None)
def __html__(self):
return ('Server name: %s '
'%s') % (self.server_info[self.S_NAME], ChunkParser.__html__(self))
def LogTrafficStatus(self, final=False):
if self.ui:
if final:
message = 'Disconnected from: %s' % self.server_info[self.S_NAME]
self.ui.Status('down', color=self.ui.GREY, message=message)
else:
self.ui.Status('traffic')
def GetKiteRequests(self, parse):
requests = []
for prefix in ('X-Beanstalk', 'X-PageKite'):
for bs in parse.Header(prefix):
# X-PageKite: proto:my.domain.com:token:signature
proto, domain, srand, token, sign = bs.split(':')
requests.append((proto.lower(), domain.lower(),
srand, token, sign, prefix))
return requests
def _FrontEnd(conn, body, conns):
"""This is what the front-end does when a back-end requests a new tunnel."""
self = Tunnel(conns)
try:
for prefix in ('X-Beanstalk', 'X-PageKite'):
for feature in conn.parser.Header(prefix+'-Features'):
if not conns.config.disable_zchunks:
if feature == 'ZChunks':
self.EnableZChunks(level=1)
elif feature == 'AddKites':
self.server_info[self.S_ADD_KITES] = True
elif feature == 'Mobile':
self.server_info[self.S_IS_MOBILE] = True
# Track which versions we see in the wild.
version = 'old'
for v in conn.parser.Header(prefix+'-Version'):
version = v
if common.gYamon:
common.gYamon.vadd('version-%s' % version, 1, wrap=10000000)
self.server_info[self.S_VERSION] = version
for replace in conn.parser.Header(prefix+'-Replace'):
if replace in self.conns.conns_by_id:
repl = self.conns.conns_by_id[replace]
self.LogInfo('Disconnecting old tunnel: %s' % repl)
repl.Die(discard_buffer=True)
requests = self.GetKiteRequests(conn.parser)
except Exception, err:
self.LogError('Discarding connection: %s' % err)
self.Cleanup()
return None
except socket.error, err:
self.LogInfo('Discarding connection: %s' % err)
self.Cleanup()
return None
self.last_activity = time.time()
self.CountAs('backends_live')
self.SetConn(conn)
if requests:
conns.auth().check(requests[:], conn,
lambda r, l: self.AuthCallback(conn, r, l))
return self
def RecheckQuota(self, conns, when=None):
if when is None: when = time.time()
if (self.quota and
self.quota[0] is not None and
self.quota[1] and
(self.quota[2] < when-900)):
self.quota[2] = when
self.LogDebug('Rechecking: %s' % (self.quota, ))
conns.auth().check(self.quota[1], self,
lambda r, l: self.QuotaCallback(conns, r, l))
def ProcessAuthResults(self, results, duplicates_ok=False, add_tunnels=True):
ok = []
bad = []
if not self.conns:
# This can be delayed until the connecting client gives up, which
# means we may have already called Die(). In that case, just abort.
return True
ok_results = ['X-PageKite-OK']
bad_results = ['X-PageKite-Invalid']
if duplicates_ok is True:
ok_results.extend(['X-PageKite-Duplicate'])
elif duplicates_ok is False:
bad_results.extend(['X-PageKite-Duplicate'])
for r in results:
if r[0] in ok_results:
ok.append(r[1])
elif r[0] in bad_results:
bad.append(r[1])
elif r[0] == 'X-PageKite-SessionID':
self.conns.SetAltId(self, r[1])
logi = []
if self.server_info[self.S_IS_MOBILE]:
logi.append(('mobile', 'True'))
if self.server_info[self.S_ADD_KITES]:
logi.append(('add_kites', 'True'))
if self.server_info[self.S_VERSION]:
logi.append(('version', self.server_info[self.S_VERSION]))
if bad:
for backend in bad:
if backend in self.backends:
del self.backends[backend]
proto, domain, srand = backend.split(':')
self.Log([('BE', 'Dead'), ('proto', proto), ('domain', domain)] + logi)
self.conns.CloseTunnel(proto, domain, self)
if add_tunnels:
for backend in ok:
if backend not in self.backends:
self.backends[backend] = 1
proto, domain, srand = backend.split(':')
self.Log([('BE', 'Live'), ('proto', proto), ('domain', domain)] + logi)
self.conns.Tunnel(proto, domain, self)
if not ok:
if self.server_info[self.S_ADD_KITES] and not bad:
self.LogDebug('No tunnels configured, idling...')
self.conns.SetIdle(self, 60)
else:
self.LogDebug('No tunnels configured, closing connection.')
self.Die()
return True
def QuotaCallback(self, conns, results, log_info):
# Report new values to the back-end... unless they are mobile.
if self.quota and (self.quota[0] >= 0):
if not self.server_info[self.S_IS_MOBILE]:
self.SendQuota()
self.ProcessAuthResults(results, duplicates_ok=True, add_tunnels=False)
for r in results:
if r[0] in ('X-PageKite-OK', 'X-PageKite-Duplicate'):
return self
# Nothing is OK anymore, give up and shut down the tunnel.
self.Log(log_info)
self.LogInfo('Ran out of quota or account deleted, closing tunnel.')
self.Die()
return self
def AuthCallback(self, conn, results, log_info):
if log_info:
logging.Log(log_info)
output = [HTTP_ResponseHeader(200, 'OK'),
HTTP_Header('Transfer-Encoding', 'chunked'),
HTTP_Header('X-PageKite-Features', 'AddKites'),
HTTP_Header('X-PageKite-Protos', ', '.join(['%s' % p
for p in self.conns.config.server_protos])),
HTTP_Header('X-PageKite-Ports', ', '.join(
['%s' % self.conns.config.server_portalias.get(p, p)
for p in self.conns.config.server_ports]))]
if not self.conns.config.disable_zchunks:
output.append(HTTP_Header('X-PageKite-Features', 'ZChunks'))
if self.conns.config.server_raw_ports:
output.append(
HTTP_Header('X-PageKite-Raw-Ports',
', '.join(['%s' % p for p
in self.conns.config.server_raw_ports])))
for r in results:
output.append('%s: %s\r\n' % r)
output.append(HTTP_StartBody())
if not self.Send(output, activity=False, just_buffer=True):
conn.LogDebug('No tunnels configured, closing connection (send failed).')
self.Die(discard_buffer=True)
return self
if conn.quota and conn.quota[0]:
self.quota = conn.quota
self.Log([('BE-Quota', self.quota[0])])
if self.ProcessAuthResults(results):
self.conns.Add(self)
else:
self.Die()
return self
def ChunkAuthCallback(self, results, log_info):
if log_info:
logging.Log(log_info)
if self.ProcessAuthResults(results):
output = ['NOOP: 1\r\n']
for r in results:
output.append('%s: %s\r\n' % r)
output.append('\r\n!')
self.SendChunked(''.join(output), compress=False, just_buffer=True)
def _RecvHttpHeaders(self, fd=None):
data = ''
fd = fd or self.fd
while not data.endswith('\r\n\r\n') and not data.endswith('\n\n'):
try:
buf = fd.recv(1)
except:
# This is sloppy, but the back-end will just connect somewhere else
# instead, so laziness here should be fine.
buf = None
if buf is None or buf == '':
self.LogDebug('Remote end closed connection.')
return None
data += buf
self.read_bytes += len(buf)
if logging.DEBUG_IO:
print '<== IN (headers) =[%s]==(\n%s)==' % (self, data)
return data
def _Connect(self, server, conns, tokens=None):
if self.fd:
self.fd.close()
sspec = rsplit(':', server)
if len(sspec) < 2:
sspec = (sspec[0], 443)
# Use chained SocksiPy to secure our communication.
socks.DEBUG = (logging.DEBUG_IO or socks.DEBUG) and logging.LogDebug
sock = socks.socksocket()
if socks.HAVE_SSL:
pp = socks.parseproxy
chain = [pp('default')]
if self.conns.config.fe_nocertcheck:
chain.append([socks.PROXY_TYPE_SSL_WEAK, sspec[0], int(sspec[1])])
elif self.conns.config.fe_certname:
chain.append(pp('http!%s!%s' % (sspec[0], sspec[1])))
chain.append(pp('ssl!%s!443' % ','.join(self.conns.config.fe_certname)))
for hop in chain:
sock.addproxy(*hop)
self.SetFD(sock)
try:
self.fd.settimeout(20.0) # Missing in Python 2.2
except:
self.fd.setblocking(1)
self.LogDebug('Connecting to %s:%s' % (sspec[0], sspec[1]))
self.fd.connect((sspec[0], int(sspec[1])))
replace_sessionid = self.conns.config.servers_sessionids.get(server, None)
if (not self.Send(HTTP_PageKiteRequest(server,
conns.config.backends,
tokens,
nozchunks=conns.config.disable_zchunks,
replace=replace_sessionid),
activity=False, try_flush=True, allow_blocking=False)
or not self.Flush(wait=True, allow_blocking=False)):
self.LogDebug('Failed to send kite request, closing.')
return None, None
data = self._RecvHttpHeaders()
if not data:
self.LogDebug('Failed to parse kite response, closing.')
return None, None
self.fd.setblocking(0)
parse = HttpLineParser(lines=data.splitlines(),
state=HttpLineParser.IN_RESPONSE)
return data, parse
def CheckForTokens(self, parse):
tcount = 0
tokens = {}
for request in parse.Header('X-PageKite-SignThis'):
proto, domain, srand, token = request.split(':')
tokens['%s:%s' % (proto, domain)] = token
tcount += 1
return tcount, tokens
def ParsePageKiteCapabilities(self, parse):
for portlist in parse.Header('X-PageKite-Ports'):
self.server_info[self.S_PORTS].extend(portlist.split(', '))
for portlist in parse.Header('X-PageKite-Raw-Ports'):
self.server_info[self.S_RAW_PORTS].extend(portlist.split(', '))
for protolist in parse.Header('X-PageKite-Protos'):
self.server_info[self.S_PROTOS].extend(protolist.split(', '))
if not self.conns.config.disable_zchunks:
for feature in parse.Header('X-PageKite-Features'):
if feature == 'ZChunks':
self.EnableZChunks(level=9)
elif feature == 'AddKites':
self.server_info[self.S_ADD_KITES] = True
elif feature == 'Mobile':
self.server_info[self.S_IS_MOBILE] = True
def HandlePageKiteResponse(self, parse):
config = self.conns.config
have_kites = 0
have_kite_info = None
sname = self.server_info[self.S_NAME]
config.ui.NotifyServer(self, self.server_info)
for misc in parse.Header('X-PageKite-Misc'):
args = parse_qs(misc)
logdata = [('FE', sname)]
for arg in args:
logdata.append((arg, args[arg][0]))
logging.Log(logdata)
if 'motd' in args and args['motd'][0]:
config.ui.NotifyMOTD(sname, args['motd'][0])
# FIXME: Really, we should keep track of quota dimensions for
# each kite. At the moment that isn't even reported...
for quota in parse.Header('X-PageKite-Quota'):
self.quota = [float(quota), None, None]
self.Log([('FE', sname), ('quota', quota)])
for quota in parse.Header('X-PageKite-QConns'):
self.q_conns = float(quota)
self.Log([('FE', sname), ('q_conns', quota)])
for quota in parse.Header('X-PageKite-QDays'):
self.q_days = float(quota)
self.Log([('FE', sname), ('q_days', quota)])
if self.quota and self.quota[0] is not None:
config.ui.NotifyQuota(self.quota[0], self.q_days, self.q_conns)
invalid_reasons = {}
for request in parse.Header('X-PageKite-Invalid-Why'):
# This is future-compatible, in that we can add more fields later.
details = request.split(';')
invalid_reasons[details[0]] = details[1]
for request in parse.Header('X-PageKite-Invalid'):
have_kite_info = True
proto, domain, srand = request.split(':')
reason = invalid_reasons.get(request, 'unknown')
self.Log([('FE', sname),
('err', 'Rejected'),
('proto', proto),
('reason', reason),
('domain', domain)])
config.ui.NotifyKiteRejected(proto, domain, reason, crit=True)
config.SetBackendStatus(domain, proto, add=BE_STATUS_ERR_TUNNEL)
for request in parse.Header('X-PageKite-Duplicate'):
have_kite_info = True
proto, domain, srand = request.split(':')
self.Log([('FE', self.server_info[self.S_NAME]),
('err', 'Duplicate'),
('proto', proto),
('domain', domain)])
config.ui.NotifyKiteRejected(proto, domain, 'duplicate')
config.SetBackendStatus(domain, proto, add=BE_STATUS_ERR_TUNNEL)
ssl_available = {}
for request in parse.Header('X-PageKite-SSL-OK'):
ssl_available[request] = True
for request in parse.Header('X-PageKite-OK'):
have_kite_info = True
have_kites += 1
proto, domain, srand = request.split(':')
self.conns.Tunnel(proto, domain, self)
status = BE_STATUS_OK
if request in ssl_available:
status |= BE_STATUS_REMOTE_SSL
self.remote_ssl[(proto, domain)] = True
self.Log([('FE', sname),
('proto', proto),
('domain', domain),
('ssl', (request in ssl_available))])
config.SetBackendStatus(domain, proto, add=status)
return have_kite_info and have_kites
def _BackEnd(server, backends, require_all, conns):
"""This is the back-end end of a tunnel."""
self = Tunnel(conns)
self.backends = backends
self.require_all = require_all
self.server_info[self.S_NAME] = server
abort = True
try:
try:
data, parse = self._Connect(server, conns)
except:
logging.LogError('Error in connect: %s' % format_exc())
raise
if data and parse:
# Collect info about front-end capabilities, for interactive config
self.ParsePageKiteCapabilities(parse)
for sessionid in parse.Header('X-PageKite-SessionID'):
conns.SetAltId(self, sessionid)
conns.config.servers_sessionids[server] = sessionid
tryagain, tokens = self.CheckForTokens(parse)
if tryagain:
if self.server_info[self.S_ADD_KITES]:
request = PageKiteRequestHeaders(server, conns.config.backends,
tokens)
abort = not self.SendChunked(('NOOP: 1\r\n%s\r\n\r\n!'
) % ''.join(request),
compress=False, just_buffer=True)
data = parse = None
else:
try:
data, parse = self._Connect(server, conns, tokens)
except:
logging.LogError('Error in connect: %s' % format_exc())
raise
if data and parse:
kites = self.HandlePageKiteResponse(parse)
abort = (kites is None) or (kites < 1)
except socket.error:
self.Cleanup()
return None
except Exception, e:
self.LogError('Server response parsing failed: %s' % e)
self.Cleanup()
return None
if abort:
return None
conns.Add(self)
self.CountAs('frontends_live')
self.last_activity = time.time()
return self
FrontEnd = staticmethod(_FrontEnd)
BackEnd = staticmethod(_BackEnd)
def Send(self, data, try_flush=False, activity=False, just_buffer=False,
allow_blocking=True):
try:
if TUNNEL_SOCKET_BLOCKS and allow_blocking and not just_buffer:
if self.fd is not None:
self.fd.setblocking(1)
return ChunkParser.Send(self, data, try_flush=try_flush,
activity=activity,
just_buffer=just_buffer,
allow_blocking=allow_blocking)
finally:
if TUNNEL_SOCKET_BLOCKS and allow_blocking and not just_buffer:
if self.fd is not None:
self.fd.setblocking(0)
def SendData(self, conn, data, sid=None, host=None, proto=None, port=None,
chunk_headers=None):
sid = int(sid or conn.sid)
if conn: self.users[sid] = conn
if not sid in self.zhistory: self.zhistory[sid] = [0, 0]
# Pass outgoing data through any defined filters
for f in self.filters:
try:
data = f.filter_data_out(self, sid, data)
except:
logging.LogError(('Ignoring error in filter_out %s: %s'
) % (f, format_exc()))
sending = ['SID: %s\r\n' % sid]
if proto: sending.append('Proto: %s\r\n' % proto)
if host: sending.append('Host: %s\r\n' % host)
if port:
porti = int(port)
if self.conns and (porti in self.conns.config.server_portalias):
sending.append('Port: %s\r\n' % self.conns.config.server_portalias[porti])
else:
sending.append('Port: %s\r\n' % port)
if chunk_headers:
for ch in chunk_headers: sending.append('%s: %s\r\n' % ch)
sending.append('\r\n')
# Small amounts of data we just send...
if len(data) <= 1024:
sending.append(data)
return self.SendChunked(sending, zhistory=self.zhistory[sid])
# Larger amounts we break into fragments to work around bugs in
# some of our small-buffered embedded clients. We aim for roughly
# one fragment per packet, assuming an MTU of 1500 bytes.
sending.append('')
frag_size = max(1024, 1400-len(''.join(sending)))
first = True
while data or first:
sending[-1] = data[:frag_size]
if not self.SendChunked(sending, zhistory=self.zhistory[sid]):
return False
data = data[frag_size:]
if first:
sending = ['SID: %s\r\n' % sid, '\r\n', '']
frag_size = max(1024, 1400-len(''.join(sending)))
first = False
return True
def SendStreamEof(self, sid, write_eof=False, read_eof=False):
return self.SendChunked('SID: %s\r\nEOF: 1%s%s\r\n\r\nBye!' % (sid,
(write_eof or not read_eof) and 'W' or '',
(read_eof or not write_eof) and 'R' or ''),
compress=False)
def EofStream(self, sid, eof_type='WR'):
if sid in self.users and self.users[sid] is not None:
write_eof = (-1 != eof_type.find('W'))
read_eof = (-1 != eof_type.find('R'))
self.users[sid].ProcessTunnelEof(read_eof=(read_eof or not write_eof),
write_eof=(write_eof or not read_eof))
def CloseStream(self, sid, stream_closed=False):
if sid in self.users:
stream = self.users[sid]
del self.users[sid]
if not stream_closed and stream is not None:
stream.CloseTunnel(tunnel_closed=True)
if sid in self.zhistory:
del self.zhistory[sid]
def ResetRemoteZChunks(self):
return self.SendChunked('NOOP: 1\r\nZRST: 1\r\n\r\n!',
compress=False, just_buffer=True)
def TriggerPing(self):
when = time.time() - PING_GRACE_MIN - PING_INTERVAL_MAX
self.last_ping = self.last_activity = when
def SendPing(self):
now = time.time()
self.last_ping = int(now)
self.LogDebug("Ping", [('host', self.server_info[self.S_NAME])])
return self.SendChunked('NOOP: 1\r\nPING: %.3f\r\n\r\n!' % now,
compress=False, just_buffer=True)
def ProcessPong(self, pong):
try:
rtt = int(1000*(time.time()-float(pong)))
if self.weighted_rtt < 0:
self.weighted_rtt = rtt
else:
self.weighted_rtt = (self.weighted_rtt + rtt)/2
self.Log([('host', self.server_info[self.S_NAME]),
('rtt', '%d' % rtt),
('wrtt', '%d' % self.weighted_rtt)])
if common.gYamon:
common.gYamon.ladd('tunnel_rtt', rtt)
common.gYamon.ladd('tunnel_wrtt', self.weighted_rtt)
except ValueError:
pass
def SendPong(self, data):
if (self.conns.config.isfrontend and
self.quota and (self.quota[0] >= 0)):
# May as well make ourselves useful!
return self.SendQuota(pong=data[:64])
else:
return self.SendChunked('NOOP: 1\r\nPONG: %s\r\n\r\n!' % data[:64],
compress=False, just_buffer=True)
def SendQuota(self, pong=''):
if pong:
pong = 'PONG: %s\r\n' % pong
if self.q_days is not None:
return self.SendChunked(('NOOP: 1\r\n%sQuota: %s\r\nQDays: %s\r\nQConns: %s\r\n\r\n!'
) % (pong, self.quota[0], self.q_days, self.q_conns),
compress=False, just_buffer=True)
else:
return self.SendChunked(('NOOP: 1\r\n%sQuota: %s\r\n\r\n!'
) % (pong, self.quota[0]),
compress=False, just_buffer=True)
def SendProgress(self, sid, conn, throttle=False):
# FIXME: Optimize this away unless meaningful progress has been made?
msg = ('NOOP: 1\r\n'
'SID: %s\r\n'
'SKB: %d\r\n') % (sid, (conn.all_out + conn.wrote_bytes)/1024)
throttle = throttle and ('SPD: %d\r\n' % conn.write_speed) or ''
return self.SendChunked('%s%s\r\n!' % (msg, throttle),
compress=False, just_buffer=True)
def ProcessCorruptChunk(self, data):
self.ResetRemoteZChunks()
return True
def Probe(self, host):
for bid in self.conns.config.backends:
be = self.conns.config.backends[bid]
if be[BE_DOMAIN] == host:
bhost, bport = (be[BE_BHOST], be[BE_BPORT])
# FIXME: Should vary probe by backend type
if self.conns.config.Ping(bhost, int(bport)) > 2:
return False
return True
def AutoThrottle(self, max_speed=None, remote=False, delay=0.2):
# Never throttle tunnels.
return True
def ProgressTo(self, parse):
try:
sid = int(parse.Header('SID')[0])
bps = int((parse.Header('SPD') or [-1])[0])
skb = int((parse.Header('SKB') or [-1])[0])
if sid in self.users:
self.users[sid].RecordProgress(skb, bps)
except:
logging.LogError(('Tunnel::ProgressTo: That made no sense! %s'
) % format_exc())
return True
# If a tunnel goes down, we just go down hard and kill all our connections.
def ProcessEofRead(self):
common.DISCONNECT_COUNT += 1
self.Die()
return False
def ProcessEofWrite(self):
return self.ProcessEofRead()
def ProcessChunkQuotaInfo(self, parse):
new_quota = 0
if parse.Header('QDays'):
self.q_days = new_quota = int(parse.Header('QDays'))
if parse.Header('QConns'):
self.q_conns = new_quota = int(parse.Header('QConns'))
if parse.Header('Quota'):
new_quota = 1
if self.quota:
self.quota[0] = int(parse.Header('Quota')[0])
else:
self.quota = [int(parse.Header('Quota')[0]), None, None]
if new_quota:
self.conns.config.ui.NotifyQuota(self.quota[0],
self.q_days, self.q_conns)
def ProcessChunkDirectives(self, parse):
if parse.Header('PONG'):
self.ProcessPong(parse.Header('PONG')[0])
if parse.Header('PING'):
return self.SendPong(parse.Header('PING')[0])
if parse.Header('ZRST') and not self.ResetZChunks():
return False
if parse.Header('SPD') or parse.Header('SKB'):
if not self.ProgressTo(parse):
return False
if parse.Header('NOOP'):
return True
return None
def FilterIncoming(self, sid, data=None, info=None):
"""Pass incoming data through filters, if we have any."""
for f in self.filters:
try:
if sid and info:
f.filter_set_sid(sid, info)
if data is not None:
data = f.filter_data_in(self, sid, data)
except:
logging.LogError(('Ignoring error in filter_in %s: %s'
) % (f, format_exc()))
return data
def GetChunkDestination(self, parse):
return ((parse.Header('Proto') or [''])[0].lower(),
(parse.Header('Port') or [''])[0].lower(),
(parse.Header('Host') or [''])[0].lower(),
(parse.Header('RIP') or [''])[0].lower(),
(parse.Header('RPort') or [''])[0].lower(),
(parse.Header('RTLS') or [''])[0].lower())
def ReplyToProbe(self, proto, sid, host):
if self.conns.config.no_probes:
what, reply = 'rejected', HTTP_NoFeConnection(proto)
elif self.Probe(host):
what, reply = 'good', HTTP_GoodBeConnection(proto)
else:
what, reply = 'back-end down', HTTP_NoBeConnection(proto)
self.LogDebug('Responding to probe for %s: %s' % (host, what))
return self.SendChunked('SID: %s\r\n\r\n%s' % (sid, reply))
def ConnectBE(self, sid, proto, port, host, rIp, rPort, rTLS, data):
conn = UserConn.BackEnd(proto, host, sid, self, port,
remote_ip=rIp, remote_port=rPort, data=data)
if self.filters:
if conn:
rewritehost = conn.config.get('rewritehost')
if rewritehost is True:
rewritehost = conn.backend[BE_BHOST]
else:
rewritehost = False
data = self.FilterIncoming(sid, data, info={
'proto': proto,
'port': port,
'host': host,
'remote_ip': rIp,
'remote_port': rPort,
'using_tls': rTLS,
'be_host': conn and conn.backend[BE_BHOST],
'be_port': conn and conn.backend[BE_BPORT],
'trusted': conn and (conn.security or
conn.config.get('insecure', False)),
'rawheaders': conn and conn.config.get('rawheaders', False),
'rewritehost': rewritehost
})
if proto in ('http', 'http2', 'http3', 'websocket'):
if conn and data.startswith(HttpSecurityFilter.REJECT):
# Pretend we need authentication for dangerous URLs
conn.Die()
conn, data, code = False, '', 500
else:
code = (conn is None) and 503 or 401
if not conn:
# conn is None means we have no back-end.
# conn is False means authentication is required.
if not self.SendChunked('SID: %s\r\n\r\n%s' % (sid,
self.HTTP_Unavail(
self.conns.config, 'be', proto, host,
code=code
)), just_buffer=True):
return False, False
else:
conn = None
elif conn and proto == 'httpfinger':
# Rewrite a finger request to HTTP.
try:
firstline, rest = data.split('\n', 1)
if conn.config.get('rewritehost', False):
rewritehost = conn.backend[BE_BHOST]
else:
rewritehost = host
if '%s' in self.conns.config.finger_path:
args = (firstline.strip(), rIp, rewritehost, rest)
else:
args = (rIp, rewritehost, rest)
data = ('GET '+self.conns.config.finger_path+' HTTP/1.1\r\n'
'X-Forwarded-For: %s\r\n'
'Connection: close\r\n'
'Host: %s\r\n\r\n%s') % args
except Exception, e:
self.LogError('Error formatting HTTP-Finger: %s' % e)
conn.Die()
conn = None
elif not conn and proto == 'https':
if not self.SendChunked('SID: %s\r\n\r\n%s' % (sid,
TLS_Unavailable(unavailable=True)),
just_buffer=True):
return False, False
if conn:
self.users[sid] = conn
if proto == 'httpfinger':
conn.fd.setblocking(1)
conn.Send(data, try_flush=True,
allow_blocking=False) or conn.Flush(wait=True,
allow_blocking=False)
self._RecvHttpHeaders(fd=conn.fd)
conn.fd.setblocking(0)
data = ''
return conn, data
def ProcessKiteUpdates(self, parse):
# Look for requests for new tunnels
if self.conns.config.isfrontend:
requests = self.GetKiteRequests(parse)
if requests:
self.conns.auth().check(requests[:], self,
lambda r, l: self.ChunkAuthCallback(r, l))
# Look for responses to requests for new tunnels
tryagain, tokens = self.CheckForTokens(parse)
if tryagain:
server = self.server_info[self.S_NAME]
backends = { }
for bid in tokens:
backends[bid] = self.conns.config.backends[bid]
request = '\r\n'.join(PageKiteRequestHeaders(server, backends, tokens))
self.SendChunked('NOOP: 1\r\n%s\r\n\r\n!' % request,
compress=False, just_buffer=True)
kites = self.HandlePageKiteResponse(parse)
if (kites is not None) and (kites < 1):
self.Die()
def ProcessChunk(self, data):
# First, we process the chunk headers.
try:
headers, data = data.split('\r\n\r\n', 1)
parse = HttpLineParser(lines=headers.splitlines(),
state=HttpLineParser.IN_HEADERS)
# Process PING/NOOP/etc: may result in a short-circuit.
rv = self.ProcessChunkDirectives(parse)
if rv is not None:
# Update quota and kite information if necessary: this data is
# always sent along with a NOOP, so checking for it here is safe.
self.ProcessChunkQuotaInfo(parse)
self.ProcessKiteUpdates(parse)
return rv
sid = int(parse.Header('SID')[0])
eof = parse.Header('EOF')
except:
logging.LogError(('Tunnel::ProcessChunk: Corrupt chunk: %s'
) % format_exc())
return False
# EOF stream?
if eof:
self.EofStream(sid, eof[0])
return True
# Headers done, not EOF: let's get the other end of this connection.
if sid in self.users:
# Either from pre-existing connections...
conn = self.users[sid]
if self.filters:
data = self.FilterIncoming(sid, data)
else:
# ... or we connect to a back-end.
proto, port, host, rIp, rPort, rTLS = self.GetChunkDestination(parse)
if proto and host:
# Probe requests are handled differently (short circuit)
if proto.startswith('probe'):
return self.ReplyToProbe(proto, sid, host)
conn, data = self.ConnectBE(sid, proto, port, host,
rIp, rPort, rTLS, data)
if conn is False:
return False
else:
conn = None
# Send the data or shut down.
if conn:
if data and not conn.Send(data, try_flush=True):
# If that failed something is wrong, but we'll let the outer
# select/epoll loop catch and handle it.
pass
if len(conn.write_blocked) > 0 and conn.created < time.time()-3:
return self.SendProgress(sid, conn, throttle=True)
else:
# No connection? Close this stream.
self.CloseStream(sid)
return self.SendStreamEof(sid) and self.Flush()
return True
class LoopbackTunnel(Tunnel):
"""A Tunnel which just loops back to this process."""
def __init__(self, conns, which, backends):
Tunnel.__init__(self, conns)
if self.fd:
self.fd = None
self.weighted_rtt = -1000
self.lock = None
self.backends = backends
self.require_all = True
self.server_info[self.S_NAME] = LOOPBACK[which]
self.other_end = None
self.which = which
self.buffer_count = 0
self.CountAs('loopbacks_live')
if which == 'FE':
for d in backends.keys():
if backends[d][BE_BHOST]:
proto, domain = d.split(':')
self.conns.Tunnel(proto, domain, self)
self.Log([('FE', self.server_info[self.S_NAME]),
('proto', proto),
('domain', domain)])
def __str__(self):
return '%s %s' % (Tunnel.__str__(self), self.which)
def Cleanup(self, close=True):
Tunnel.Cleanup(self, close=close)
other = self.other_end
self.other_end = None
if other and other.other_end:
other.Cleanup(close=close)
def Linkup(self, other):
"""Links two LoopbackTunnels together."""
self.other_end = other
other.other_end = self
return other
def _Loop(conns, backends):
"""Creates a loop, returning the back-end tunnel object."""
return LoopbackTunnel(conns, 'FE', backends
).Linkup(LoopbackTunnel(conns, 'BE', backends))
Loop = staticmethod(_Loop)
# FIXME: This is a zero-length tunnel, but the code relies in some places
# on the tunnel having a length. We really need a pipe here, or
# things will go horribly wrong now and then. For now we hack this by
# separating Write and Flush and looping back only on Flush.
def Send(self, data, try_flush=False, activity=False, just_buffer=True,
allow_blocking=True):
if self.write_blocked:
data = [self.write_blocked] + data
self.write_blocked = ''
joined_data = ''.join(data)
if try_flush or (len(joined_data) > 10240) or (self.buffer_count >= 100):
if logging.DEBUG_IO:
print '|%s| %s \n|%s| %s' % (self.which, self, self.which, data)
self.buffer_count = 0
return self.other_end.ProcessData(joined_data)
else:
self.buffer_count += 1
self.write_blocked = joined_data
return True
class UserConn(Selectable):
"""A Selectable representing a user's connection."""
def __init__(self, address, ui=None):
Selectable.__init__(self, address=address, ui=ui)
self.Reset()
def Reset(self):
self.tunnel = None
self.conns = None
self.backend = BE_NONE[:]
self.config = {}
self.security = None
def Cleanup(self, close=True):
if close:
self.CloseTunnel()
Selectable.Cleanup(self, close=close)
self.Reset()
def ConnType(self):
if self.backend[BE_BHOST]:
return 'BE=%s:%s' % (self.backend[BE_BHOST], self.backend[BE_BPORT])
else:
return 'FE'
def __str__(self):
return '%s %s' % (Selectable.__str__(self), self.ConnType())
def __html__(self):
return ('Tunnel: %s '
'%s') % (self.tunnel and self.tunnel.sid or '',
escape_html('%s' % (self.tunnel or '')),
Selectable.__html__(self))
def IsReadable(self, now):
if self.tunnel and self.tunnel.IsBlocked():
return False
return Selectable.IsReadable(self, now)
def CloseTunnel(self, tunnel_closed=False):
tunnel, self.tunnel = self.tunnel, None
if tunnel and not tunnel_closed:
tunnel.SendStreamEof(self.sid, write_eof=True, read_eof=True)
tunnel.CloseStream(self.sid, stream_closed=True)
self.ProcessTunnelEof(read_eof=True, write_eof=True)
def _FrontEnd(conn, address, proto, host, on_port, body, conns):
# This is when an external user connects to a server and requests a
# web-page. We have to give it to them!
self = UserConn(address, ui=conns.config.ui)
self.conns = conns
self.SetConn(conn)
if ':' in host: host, port = host.split(':', 1)
self.proto = proto
self.host = StripEncodedIP(host)
# If the listening port is an alias for another...
if int(on_port) in conns.config.server_portalias:
on_port = conns.config.server_portalias[int(on_port)]
# Try and find the right tunnel. We prefer proto/port specifications first,
# then the just the proto. If the protocol is WebSocket and no tunnel is
# found, look for a plain HTTP tunnel.
if proto.startswith('probe'):
protos = ['http', 'https', 'websocket', 'raw', 'irc',
'finger', 'httpfinger']
ports = conns.config.server_ports[:]
ports.extend(conns.config.server_aliasport.keys())
ports.extend([x for x in conns.config.server_raw_ports if x != VIRTUAL_PN])
else:
protos = [proto]
ports = [on_port]
if proto == 'websocket': protos.append('http')
elif proto == 'http': protos.extend(['http2', 'http3'])
tunnels = None
for p in protos:
for prt in ports:
if not tunnels: tunnels = conns.Tunnel('%s-%s' % (p, prt), host)
if not tunnels: tunnels = conns.Tunnel(p, host)
if not tunnels: tunnels = conns.Tunnel(protos[0], CATCHALL_HN)
if self.address:
chunk_headers = [('RIP', self.address[0]), ('RPort', self.address[1])]
if conn.my_tls: chunk_headers.append(('RTLS', 1))
if tunnels:
if len(tunnels) > 1:
tunnels.sort(key=lambda t: t.weighted_rtt)
self.tunnel = tunnels[0]
if (self.tunnel and self.tunnel.SendData(self, ''.join(body), host=host,
proto=proto, port=on_port,
chunk_headers=chunk_headers)
and self.conns):
self.Log([('domain', self.host), ('on_port', on_port), ('proto', self.proto), ('is', 'FE')])
self.conns.Add(self)
if proto.startswith('http'):
self.conns.TrackIP(address[0], host)
# FIXME: Use the tracked data to detect & mitigate abuse?
return self
else:
self.LogDebug('No back-end', [('on_port', on_port), ('proto', self.proto),
('domain', self.host), ('is', 'FE')])
self.Cleanup(close=False)
return None
def _BackEnd(proto, host, sid, tunnel, on_port,
remote_ip=None, remote_port=None, data=None):
# This is when we open a backend connection, because a user asked for it.
self = UserConn(None, ui=tunnel.conns.config.ui)
self.sid = sid
self.proto = proto
self.host = host
self.conns = tunnel.conns
self.tunnel = tunnel
failure = None
# Try and find the right back-end. We prefer proto/port specifications
# first, then the just the proto. If the protocol is WebSocket and no
# tunnel is found, look for a plain HTTP tunnel. Fallback hosts can
# be registered using the http2/3/4 protocols.
backend = None
if proto == 'http':
protos = [proto, 'http2', 'http3']
elif proto.startswith('probe'):
protos = ['http', 'http2', 'http3']
elif proto == 'websocket':
protos = [proto, 'http', 'http2', 'http3']
else:
protos = [proto]
for p in protos:
if not backend:
p_p = '%s-%s' % (p, on_port)
backend, be = self.conns.config.GetBackendServer(p_p, host)
if not backend:
backend, be = self.conns.config.GetBackendServer(p, host)
if not backend:
backend, be = self.conns.config.GetBackendServer(p, CATCHALL_HN)
if backend:
break
logInfo = [
('on_port', on_port),
('proto', proto),
('domain', host),
('is', 'BE')
]
if remote_ip:
logInfo.append(('remote_ip', remote_ip))
# Strip off useless IPv6 prefix, if this is an IPv4 address.
if remote_ip.startswith('::ffff:') and ':' not in remote_ip[7:]:
remote_ip = remote_ip[7:]
if not backend or not backend[0]:
self.ui.Notify(('%s - %s://%s:%s (FAIL: no server)'
) % (remote_ip or 'unknown', proto, host, on_port),
prefix='?', color=self.ui.YELLOW)
else:
http_host = '%s/%s' % (be[BE_DOMAIN], be[BE_PORT] or '80')
self.backend = be
self.config = host_config = self.conns.config.be_config.get(http_host, {})
# Access control interception: check remote IP addresses first.
ip_keys = [k for k in host_config if k.startswith('ip/')]
if ip_keys:
k1 = 'ip/%s' % remote_ip
k2 = '.'.join(k1.split('.')[:-1])
if not (k1 in host_config or k2 in host_config):
self.ui.Notify(('%s - %s://%s:%s (IP ACCESS DENIED)'
) % (remote_ip or 'unknown', proto, host, on_port),
prefix='!', color=self.ui.YELLOW)
logInfo.append(('forbidden-ip', '%s' % remote_ip))
backend = None
else:
self.security = 'ip'
# Access control interception: check for HTTP Basic authentication.
user_keys = [k for k in host_config if k.startswith('password/')]
if user_keys:
user, pwd, fail = None, None, True
if proto in ('websocket', 'http', 'http2', 'http3'):
parse = HttpLineParser(lines=data.splitlines())
auth = parse.Header('Authorization')
try:
(how, ab64) = auth[0].strip().split()
if how.lower() == 'basic':
user, pwd = base64.decodestring(ab64).split(':')
except:
user = auth
user_key = 'password/%s' % user
if user and user_key in host_config:
if host_config[user_key] == pwd:
fail = False
if fail:
if logging.DEBUG_IO:
print '=== REQUEST\n%s\n===' % data
self.ui.Notify(('%s - %s://%s:%s (USER ACCESS DENIED)'
) % (remote_ip or 'unknown', proto, host, on_port),
prefix='!', color=self.ui.YELLOW)
logInfo.append(('forbidden-user', '%s' % user))
backend = None
failure = ''
else:
self.security = 'password'
if not backend:
logInfo.append(('err', 'No back-end'))
self.Log(logInfo)
self.Cleanup(close=False)
return failure
try:
self.SetFD(rawsocket(socket.AF_INET, socket.SOCK_STREAM))
try:
self.fd.settimeout(2.0) # Missing in Python 2.2
except:
self.fd.setblocking(1)
sspec = list(backend)
if len(sspec) == 1: sspec.append(80)
self.fd.connect(tuple(sspec))
self.fd.setblocking(0)
except socket.error, err:
logInfo.append(('socket_error', '%s' % err))
self.ui.Notify(('%s - %s://%s:%s (FAIL: %s:%s is down)'
) % (remote_ip or 'unknown', proto, host, on_port,
sspec[0], sspec[1]),
prefix='!', color=self.ui.YELLOW)
self.Log(logInfo)
self.Cleanup(close=False)
return None
sspec = (sspec[0], sspec[1])
be_name = (sspec == self.conns.config.ui_sspec) and 'builtin' or ('%s:%s' % sspec)
self.ui.Status('serving')
self.ui.Notify(('%s < %s://%s:%s (%s)'
) % (remote_ip or 'unknown', proto, host, on_port, be_name))
self.Log(logInfo)
self.conns.Add(self)
return self
FrontEnd = staticmethod(_FrontEnd)
BackEnd = staticmethod(_BackEnd)
def Shutdown(self, direction):
try:
if self.fd:
if 'sock_shutdown' in dir(self.fd):
# This is a pyOpenSSL socket, which has incompatible shutdown.
if direction == socket.SHUT_RD:
self.fd.shutdown()
else:
self.fd.sock_shutdown(direction)
else:
self.fd.shutdown(direction)
except Exception, e:
pass
def ProcessTunnelEof(self, read_eof=False, write_eof=False):
rv = True
if write_eof and not self.read_eof:
rv = self.ProcessEofRead(tell_tunnel=False) and rv
if read_eof and not self.write_eof:
rv = self.ProcessEofWrite(tell_tunnel=False) and rv
return rv
def ProcessEofRead(self, tell_tunnel=True):
self.read_eof = True
self.Shutdown(socket.SHUT_RD)
if tell_tunnel and self.tunnel:
self.tunnel.SendStreamEof(self.sid, read_eof=True)
return self.ProcessEof()
def ProcessEofWrite(self, tell_tunnel=True):
self.write_eof = True
if not self.write_blocked:
self.Shutdown(socket.SHUT_WR)
if tell_tunnel and self.tunnel:
self.tunnel.SendStreamEof(self.sid, write_eof=True)
if (self.conns and
self.ConnType() == 'FE' and
(not self.read_eof)):
self.conns.SetIdle(self, 120)
return self.ProcessEof()
def Send(self, data, try_flush=False, activity=True, just_buffer=False,
allow_blocking=True):
rv = Selectable.Send(self, data, try_flush=try_flush, activity=activity,
just_buffer=just_buffer,
allow_blocking=allow_blocking)
if self.write_eof and not self.write_blocked:
self.Shutdown(socket.SHUT_WR)
elif try_flush or not self.write_blocked:
if self.tunnel:
self.tunnel.SendProgress(self.sid, self)
return rv
def ProcessData(self, data):
if not self.tunnel:
self.LogError('No tunnel! %s' % self)
return False
if not self.tunnel.SendData(self, data):
self.LogDebug('Send to tunnel failed')
return False
# Back off if tunnel is stuffed.
if self.tunnel and len(self.tunnel.write_blocked) > 1024000:
# FIXME: think about this...
self.Throttle(delay=(len(self.tunnel.write_blocked)-204800)/max(50000,
self.tunnel.write_speed))
if self.read_eof:
return self.ProcessEofRead()
return True
class UnknownConn(MagicProtocolParser):
"""This class is a connection which we're not sure what is yet."""
def __init__(self, fd, address, on_port, conns):
MagicProtocolParser.__init__(self, fd, address, on_port, ui=conns.config.ui)
self.peeking = True
# Set up our parser chain.
self.parsers = [HttpLineParser]
if IrcLineParser.PROTO in conns.config.server_protos:
self.parsers.append(IrcLineParser)
if FingerLineParser.PROTO in conns.config.server_protos:
self.parsers.append(FingerLineParser)
self.parser = MagicLineParser(parsers=self.parsers)
self.conns = conns
self.conns.Add(self)
self.conns.SetIdle(self, 10)
self.sid = -1
self.host = None
self.proto = None
self.said_hello = False
self.bad_loops = 0
def Cleanup(self, close=True):
MagicProtocolParser.Cleanup(self, close=close)
self.conns = self.parser = None
def SayHello(self):
if self.said_hello:
return False
else:
self.said_hello = True
if self.on_port in (25, 125, 2525):
# FIXME: We don't actually support SMTP yet and 125 is bogus.
self.Send(['220 ready ESMTP PageKite Magic Proxy\n'], try_flush=True)
return True
def __str__(self):
return '%s (%s/%s:%s)' % (MagicProtocolParser.__str__(self),
(self.proto or '?'),
(self.on_port or '?'),
(self.host or '?'))
# Any sort of EOF just means give up: if we haven't figured out what
# kind of connnection this is yet, we won't without more data.
def ProcessEofRead(self):
self.Die(discard_buffer=True)
return self.ProcessEof()
def ProcessEofWrite(self):
self.Die(discard_buffer=True)
return self.ProcessEof()
def ProcessLine(self, line, lines):
if not self.parser: return True
if self.parser.Parse(line) is False: return False
if not self.parser.ParsedOK(): return True
self.parser = self.parser.last_parser
if self.parser.protocol == HttpLineParser.PROTO:
# HTTP has special cases, including CONNECT etc.
return self.ProcessParsedHttp(line, lines)
else:
return self.ProcessParsedMagic(self.parser.PROTOS, line, lines)
def ProcessParsedMagic(self, protos, line, lines):
if (self.conns and
self.conns.config.CheckTunnelAcls(self.address, conn=self)):
for proto in protos:
if UserConn.FrontEnd(self, self.address,
proto, self.parser.domain, self.on_port,
self.parser.lines + lines, self.conns) is not None:
self.Cleanup(close=False)
return True
self.Send([self.parser.ErrorReply(port=self.on_port)], try_flush=True)
self.Cleanup()
return False
def ProcessParsedHttp(self, line, lines):
done = False
if self.parser.method == 'PING':
self.Send('PONG %s\r\n\r\n' % self.parser.path)
self.read_eof = self.write_eof = done = True
self.fd.close()
elif self.parser.method == 'CONNECT':
if self.parser.path.lower().startswith('pagekite:'):
if not self.conns.config.CheckTunnelAcls(self.address, conn=self):
self.Send(HTTP_ConnectBad(code=403, status='Forbidden'),
try_flush=True)
return False
if Tunnel.FrontEnd(self, lines, self.conns) is None:
self.Send(HTTP_ConnectBad(), try_flush=True)
return False
done = True
else:
try:
connect_parser = self.parser
chost, cport = connect_parser.path.split(':', 1)
cport = int(cport)
chost = StripEncodedIP(chost.lower())
sid1 = ':%s' % chost
sid2 = '-%s:%s' % (cport, chost)
tunnels = self.conns.tunnels
if not self.conns.config.CheckClientAcls(self.address, conn=self):
self.Send(self.HTTP_Unavail(
self.conns.config, 'fe', 'raw', chost,
code=403, status='Forbidden'),
try_flush=True)
return False
# These allow explicit CONNECTs to direct http(s) or raw backends.
# If no match is found, we throw an error.
if cport in (80, 8080):
if (('http'+sid1) in tunnels) or (
('http'+sid2) in tunnels) or (
('http2'+sid1) in tunnels) or (
('http2'+sid2) in tunnels) or (
('http3'+sid1) in tunnels) or (
('http3'+sid2) in tunnels):
(self.on_port, self.host) = (cport, chost)
self.parser = HttpLineParser()
self.Send(HTTP_ConnectOK(), try_flush=True)
return True
whost = chost
if '.' in whost:
whost = '*.' + '.'.join(whost.split('.')[1:])
if cport == 443:
if (('https'+sid1) in tunnels) or (
('https'+sid2) in tunnels) or (
chost in self.conns.config.tls_endpoints) or (
whost in self.conns.config.tls_endpoints):
(self.on_port, self.host) = (cport, chost)
self.parser = HttpLineParser()
self.Send(HTTP_ConnectOK(), try_flush=True)
return self.ProcessTls(''.join(lines), chost)
if (cport in self.conns.config.server_raw_ports or
VIRTUAL_PN in self.conns.config.server_raw_ports):
for raw in ('raw', 'finger'):
if ((raw+sid1) in tunnels) or ((raw+sid2) in tunnels):
(self.on_port, self.host) = (cport, chost)
self.parser = HttpLineParser()
self.Send(HTTP_ConnectOK(), try_flush=True)
return self.ProcessProto(''.join(lines), raw, self.host)
self.Send(HTTP_ConnectBad(), try_flush=True)
return False
except ValueError:
pass
if (not done and self.parser.method == 'POST'
and self.parser.path in MAGIC_PATHS):
# FIXME: DEPRECATE: Make this go away!
if not self.conns.config.CheckTunnelAcls(self.address, conn=self):
self.Send(HTTP_ConnectBad(code=403, status='Forbidden'),
try_flush=True)
return False
if Tunnel.FrontEnd(self, lines, self.conns) is None:
self.Send(HTTP_ConnectBad(), try_flush=True)
return False
done = True
if not done:
if not self.host:
hosts = self.parser.Header('Host')
if hosts:
self.host = StripEncodedIP(hosts[0].lower())
else:
self.Send(HTTP_Response(400, 'Bad request',
['
400 Bad request
',
'
Invalid request, no Host: found.
',
'\n'],
trackable=True,
overloaded=self.conns.config.Overloaded()))
return False
if self.parser.path.startswith(MAGIC_PREFIX):
try:
self.host = StripEncodedIP(self.parser.path.split('/')[2])
if self.parser.path.endswith('.json'):
self.proto = 'probe.json'
else:
self.proto = 'probe'
except ValueError:
pass
if self.proto is None:
self.proto = 'http'
upgrade = self.parser.Header('Upgrade')
if 'websocket' in self.conns.config.server_protos:
if upgrade and upgrade[0].lower() == 'websocket':
self.proto = 'websocket'
if not self.conns.config.CheckClientAcls(self.address, conn=self):
self.Send(self.HTTP_Unavail(
self.conns.config, 'fe', self.proto, self.host,
code=403, status='Forbidden'),
try_flush=True)
return False
address = self.address
if int(self.on_port) in self.conns.config.server_portalias:
xfwdf = self.parser.Header('X-Forwarded-For')
if xfwdf and address[0] == '127.0.0.1':
address = (xfwdf[0], address[1])
done = True
if UserConn.FrontEnd(self, address,
self.proto, self.host, self.on_port,
self.parser.lines + lines, self.conns) is None:
if self.proto.startswith('probe'):
self.Send(HTTP_NoFeConnection(self.proto),
try_flush=True)
else:
self.Send(self.HTTP_Unavail(
self.conns.config, 'fe', self.proto, self.host,
overloaded=self.conns.config.Overloaded()
), try_flush=True)
return False
# We are done!
self.Cleanup(close=False)
return True
def ProcessTls(self, data, domain=None):
if (not self.conns or
not self.conns.config.CheckClientAcls(self.address, conn=self)):
self.Send(TLS_Unavailable(forbidden=True), try_flush=True)
return False
if domain:
domains = [domain]
else:
try:
domains = self.GetSni(data)
if not domains:
domains = [self.conns.config.tls_default]
if domains[0]:
self.LogDebug('No SNI - trying: %s' % domains[0])
else:
domains = None
except:
# Probably insufficient data, just True and assume we'll have
# better luck on the next round... but with a timeout.
self.bad_loops += 1
if self.bad_loops < 25:
self.LogDebug('Error in ProcessTLS, will time out in 120 seconds.')
self.conns.SetIdle(self, 120)
return True
else:
self.LogDebug('Persistent error in ProcessTLS, aborting.')
self.Send(TLS_Unavailable(unavailable=True), try_flush=True)
return False
if domains and domains[0] is not None:
if UserConn.FrontEnd(self, self.address,
'https', domains[0], self.on_port,
[data], self.conns) is not None:
# We are done!
self.EatPeeked()
self.Cleanup(close=False)
return True
else:
# If we know how to terminate the TLS/SSL, do so!
ctx = self.conns.config.GetTlsEndpointCtx(domains[0])
if ctx:
self.fd = socks.SSL_Connect(ctx, self.fd,
accepted=True, server_side=True)
self.peeking = False
self.is_tls = False
self.my_tls = True
self.conns.SetIdle(self, 120)
return True
else:
self.Send(TLS_Unavailable(unavailable=True), try_flush=True)
return False
self.Send(TLS_Unavailable(unavailable=True), try_flush=True)
return False
def ProcessFlashPolicyRequest(self, data):
# FIXME: Should this be configurable?
self.LogDebug('Sending friendly response to Flash Policy Request')
self.Send('\n'
' \n'
'\n',
try_flush=True)
return False
def ProcessProto(self, data, proto, domain):
if (not self.conns or
not self.conns.config.CheckClientAcls(self.address, conn=self)):
return False
if UserConn.FrontEnd(self, self.address,
proto, domain, self.on_port,
[data], self.conns) is None:
return False
# We are done!
self.Cleanup(close=False)
return True
class UiConn(LineParser):
STATE_PASSWORD = 0
STATE_LIVE = 1
def __init__(self, fd, address, on_port, conns):
LineParser.__init__(self, fd=fd, address=address, on_port=on_port)
self.state = self.STATE_PASSWORD
self.conns = conns
self.conns.Add(self)
self.lines = []
self.qc = threading.Condition()
self.challenge = sha1hex('%s%8.8x' % (globalSecret(),
random.randint(0, 0x7FFFFFFD)+1))
self.expect = signToken(token=self.challenge,
secret=self.conns.config.ConfigSecret(),
payload=self.challenge,
length=1000)
self.LogDebug('Expecting: %s' % self.expect)
self.Send('PageKite? %s\r\n' % self.challenge)
def readline(self):
self.qc.acquire()
while not self.lines: self.qc.wait()
line = self.lines.pop(0)
self.qc.release()
return line
def write(self, data):
self.conns.config.ui_wfile.write(data)
self.Send(data)
def Cleanup(self):
self.conns.config.ui.wfile = self.conns.config.ui_wfile
self.conns.config.ui.rfile = self.conns.config.ui_rfile
self.lines = self.conns.config.ui_conn = None
self.conns = None
LineParser.Cleanup(self)
def Disconnect(self):
self.Send('Goodbye')
self.Cleanup()
def ProcessLine(self, line, lines):
if self.state == self.STATE_LIVE:
self.qc.acquire()
self.lines.append(line)
self.qc.notify()
self.qc.release()
return True
elif self.state == self.STATE_PASSWORD:
if line.strip() == self.expect:
if self.conns.config.ui_conn: self.conns.config.ui_conn.Disconnect()
self.conns.config.ui_conn = self
self.conns.config.ui.wfile = self
self.conns.config.ui.rfile = self
self.state = self.STATE_LIVE
self.Send('OK!\r\n')
return True
else:
self.Send('Sorry.\r\n')
return False
else:
return False
class RawConn(Selectable):
"""This class is a raw/timed connection."""
def __init__(self, fd, address, on_port, conns):
Selectable.__init__(self, fd, address, on_port)
self.my_tls = False
self.is_tls = False
domain = conns.LastIpDomain(address[0])
if domain and UserConn.FrontEnd(self, address, 'raw', domain, on_port,
[], conns):
self.Cleanup(close=False)
else:
self.Cleanup()
class Listener(Selectable):
"""This class listens for incoming connections and accepts them."""
def __init__(self, host, port, conns, backlog=100,
connclass=UnknownConn, quiet=False, acl=None):
Selectable.__init__(self, bind=(host, port), backlog=backlog)
self.Log([('listen', '%s:%s' % (host, port))])
if not quiet:
conns.config.ui.Notify(' - Listening on %s:%s' % (host or '*', port))
self.acl = acl
self.acl_match = None
self.connclass = connclass
self.port = port
self.conns = conns
self.conns.Add(self)
self.CountAs('listeners_live')
def __str__(self):
return '%s port=%s' % (Selectable.__str__(self), self.port)
def __html__(self):
return '
Listening on port %s for %s
' % (self.port, self.connclass)
def check_acl(self, ipaddr, default=True):
if self.acl:
try:
ipaddr = '%s' % ipaddr
lc = 0
for line in open(self.acl, 'r'):
line = line.lower().strip()
lc += 1
if line.startswith('#') or not line:
continue
try:
words = line.split()
pattern, rule = words[:2]
reason = ' '.join(words[2:])
if ipaddr == pattern:
self.acl_match = (lc, pattern, rule, reason)
return bool('allow' in rule)
elif re.compile(pattern).match(ipaddr):
self.acl_match = (lc, pattern, rule, reason)
return bool('allow' in rule)
except IndexError:
self.LogDebug('Invalid line %d in ACL %s' % (lc, self.acl))
except:
self.LogDebug('Failed to read/parse %s' % self.acl)
self.acl_match = (0, '.*', default and 'allow' or 'reject', 'Default')
return default
def ReadData(self, maxread=None):
try:
self.last_activity = time.time()
client, address = self.fd.accept()
if client:
if self.check_acl(address[0]):
log_info = [('accept', '%s:%s' % (obfuIp(address[0]), address[1]))]
uc = self.connclass(client, address, self.port, self.conns)
else:
log_info = [('reject', '%s:%s' % (obfuIp(address[0]), address[1]))]
client.close()
if self.acl:
log_info.extend([('acl_line', '%s' % self.acl_match[0]),
('reason', self.acl_match[3])])
self.Log(log_info)
return True
except IOError, err:
self.LogDebug('Listener::ReadData: error: %s (%s)' % (err, err.errno))
except socket.error, (errno, msg):
self.LogInfo('Listener::ReadData: error: %s (errno=%s)' % (msg, errno))
except Exception, e:
self.LogDebug('Listener::ReadData: %s' % e)
return True
pagekite-0.5.9.3/pagekite/proto/selectables.py 0000755 0000000 0000000 00000071010 13232067545 021222 0 ustar root root 0000000 0000000 """
Selectables are low level base classes which cooperate with our select-loop.
"""
##############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
##############################################################################
import errno
import re
import struct
import threading
import time
import zlib
from pagekite.compat import *
from pagekite.common import *
from pagekite.proto.proto import HTTP_Unavailable
import pagekite.logging as logging
import pagekite.compat as compat
import pagekite.common as common
def obfuIp(ip):
quads = ('%s' % ip).replace(':', '.').split('.')
return '~%s' % '.'.join([q for q in quads[-2:]])
SELECTABLE_LOCK = threading.Lock()
SELECTABLE_ID = 0
SELECTABLES = {}
def getSelectableId(what):
global SELECTABLES, SELECTABLE_ID, SELECTABLE_LOCK
try:
SELECTABLE_LOCK.acquire()
count = 0
while SELECTABLE_ID in SELECTABLES:
SELECTABLE_ID += 1
SELECTABLE_ID %= 0x10000
if (SELECTABLE_ID % 0x00800) == 0:
logging.LogDebug('Selectable map: %s' % (SELECTABLES, ))
count += 1
if count > 0x10001:
raise ValueError('Too many conns!')
SELECTABLES[SELECTABLE_ID] = what
return SELECTABLE_ID
finally:
SELECTABLE_LOCK.release()
class Selectable(object):
"""A wrapper around a socket, for use with select."""
HARMLESS_ERRNOS = (errno.EINTR, errno.EAGAIN, errno.ENOMEM, errno.EBUSY,
errno.EDEADLK, errno.EWOULDBLOCK, errno.ENOBUFS,
errno.EALREADY)
def __init__(self, fd=None, address=None, on_port=None, maxread=16*1024,
ui=None, tracked=True, bind=None, backlog=100):
self.fd = None
try:
if bind and bind[0] and re.match(r'^\d+\.\d+\.\d+\.\d+$', bind[0]):
raise ValueError('Avoid INET6 for IPv4 hosts')
self.SetFD(fd or rawsocket(socket.AF_INET6, socket.SOCK_STREAM), six=True)
if bind:
self.fd.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
self.fd.bind(bind)
self.fd.listen(backlog)
self.fd.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
except:
self.SetFD(fd or rawsocket(socket.AF_INET, socket.SOCK_STREAM))
if bind:
self.fd.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
self.fd.bind(bind)
self.fd.listen(backlog)
self.fd.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
self.address = address
self.on_port = on_port
self.created = self.bytes_logged = time.time()
self.last_activity = 0
self.dead = False
self.ui = ui
# Quota-related stuff
self.quota = None
self.q_conns = None
self.q_days = None
# Read-related variables
self.maxread = maxread
self.read_bytes = self.all_in = 0
self.read_eof = False
self.peeking = False
self.peeked = 0
# Write-related variables
self.wrote_bytes = self.all_out = 0
self.write_blocked = ''
self.write_speed = 102400
self.write_eof = False
self.write_retry = None
# Flow control v1
self.throttle_until = (time.time() - 1)
self.max_read_speed = 96*1024
# Flow control v2
self.acked_kb_delta = 0
# Compression stuff
self.lock = threading.Lock()
self.zw = None
self.zlevel = 1
self.zreset = False
# Logging
self.alt_id = None
self.countas = 'selectables_live'
self.sid = self.gsid = getSelectableId(self.countas)
if address:
addr = address or ('x.x.x.x', 'x')
self.log_id = 's%x/%s:%s' % (self.sid, obfuIp(addr[0]), addr[1])
else:
self.log_id = 's%x' % self.sid
if common.gYamon:
common.gYamon.vadd(self.countas, 1)
common.gYamon.vadd('selectables', 1)
def CountAs(self, what):
if common.gYamon:
common.gYamon.vadd(self.countas, -1)
common.gYamon.vadd(what, 1)
self.countas = what
global SELECTABLES
SELECTABLES[self.gsid] = '%s %s' % (self.countas, self)
def Cleanup(self, close=True):
self.peeked = self.zw = ''
self.Die(discard_buffer=True)
if close:
if self.fd:
if logging.DEBUG_IO:
self.LogDebug('Closing FD: %s' % self)
self.fd.close()
self.fd = None
if not self.dead:
self.dead = True
self.CountAs('selectables_dead')
if close:
self.LogTraffic(final=True)
def __del__(self):
try:
if common.gYamon:
common.gYamon.vadd(self.countas, -1)
common.gYamon.vadd('selectables', -1)
except AttributeError:
pass
try:
global SELECTABLES
del SELECTABLES[self.gsid]
except (KeyError, TypeError):
pass
def __str__(self):
return '%s: %s<%s%s%s>' % (self.log_id, self.__class__,
self.read_eof and '-' or 'r',
self.write_eof and '-' or 'w',
len(self.write_blocked))
def __html__(self):
try:
peer = self.fd.getpeername()
sock = self.fd.getsockname()
except:
peer = ('x.x.x.x', 'x')
sock = ('x.x.x.x', 'x')
return ('Outgoing ZChunks: %s '
'Buffered bytes: %s '
'Remote address: %s '
'Local address: %s '
'Bytes in / out: %s / %s '
'Created: %s '
'Status: %s '
'\n') % (self.zw and ('level %d' % self.zlevel) or 'off',
len(self.write_blocked),
self.dead and '-' or (obfuIp(peer[0]), peer[1]),
self.dead and '-' or (obfuIp(sock[0]), sock[1]),
self.all_in + self.read_bytes,
self.all_out + self.wrote_bytes,
time.strftime('%Y-%m-%d %H:%M:%S',
time.localtime(self.created)),
self.dead and 'dead' or 'alive')
def ResetZChunks(self):
if self.zw:
self.zreset = True
self.zw = zlib.compressobj(self.zlevel)
def EnableZChunks(self, level=1):
self.zlevel = level
self.zw = zlib.compressobj(level)
def SetFD(self, fd, six=False):
if self.fd:
self.fd.close()
self.fd = fd
if fd:
self.fd.setblocking(0)
try:
if six:
self.fd.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0)
# This hurts mobile devices, let's try living without it
#self.fd.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)
#self.fd.setsockopt(socket.SOL_TCP, socket.TCP_KEEPIDLE, 60)
#self.fd.setsockopt(socket.SOL_TCP, socket.TCP_KEEPCNT, 10)
#self.fd.setsockopt(socket.SOL_TCP, socket.TCP_KEEPINTVL, 1)
except:
pass
def SetConn(self, conn):
self.SetFD(conn.fd)
self.log_id = conn.log_id
self.read_bytes = conn.read_bytes
self.wrote_bytes = conn.wrote_bytes
def Log(self, values):
if self.log_id: values.append(('id', self.log_id))
logging.Log(values)
def LogError(self, error, params=None):
values = params or []
if self.log_id: values.append(('id', self.log_id))
logging.LogError(error, values)
def LogDebug(self, message, params=None):
values = params or []
if self.log_id: values.append(('id', self.log_id))
logging.LogDebug(message, values)
def LogInfo(self, message, params=None):
values = params or []
if self.log_id: values.append(('id', self.log_id))
logging.LogInfo(message, values)
def LogTrafficStatus(self, final=False):
if self.ui:
self.ui.Status('traffic')
def LogTraffic(self, final=False):
if self.wrote_bytes or self.read_bytes:
now = time.time()
self.all_out += self.wrote_bytes
self.all_in += self.read_bytes
self.LogTrafficStatus(final)
if common.gYamon:
common.gYamon.vadd("bytes_all", self.wrote_bytes
+ self.read_bytes, wrap=1000000000)
if final:
self.Log([('wrote', '%d' % self.wrote_bytes),
('wbps', '%d' % self.write_speed),
('read', '%d' % self.read_bytes),
('eof', '1')])
else:
self.Log([('wrote', '%d' % self.wrote_bytes),
('wbps', '%d' % self.write_speed),
('read', '%d' % self.read_bytes)])
self.bytes_logged = now
self.wrote_bytes = self.read_bytes = 0
elif final:
self.Log([('eof', '1')])
global SELECTABLES
SELECTABLES[self.gsid] = '%s %s' % (self.countas, self)
def SayHello(self):
pass
def ProcessData(self, data):
self.LogError('Selectable::ProcessData: Should be overridden!')
return False
def ProcessEof(self):
global SELECTABLES
SELECTABLES[self.gsid] = '%s %s' % (self.countas, self)
if self.read_eof and self.write_eof and not self.write_blocked:
self.Cleanup()
return False
return True
def ProcessEofRead(self):
self.read_eof = True
self.LogError('Selectable::ProcessEofRead: Should be overridden!')
return False
def ProcessEofWrite(self):
self.write_eof = True
self.LogError('Selectable::ProcessEofWrite: Should be overridden!')
return False
def EatPeeked(self, eat_bytes=None, keep_peeking=False):
if not self.peeking: return
if eat_bytes is None: eat_bytes = self.peeked
discard = ''
while len(discard) < eat_bytes:
try:
discard += self.fd.recv(eat_bytes - len(discard))
except socket.error, (errno, msg):
self.LogInfo('Error reading (%d/%d) socket: %s (errno=%s)' % (
eat_bytes, self.peeked, msg, errno))
time.sleep(0.1)
if logging.DEBUG_IO:
print '===[ ATE %d PEEKED BYTES ]===\n' % eat_bytes
self.peeked -= eat_bytes
self.peeking = keep_peeking
return
def ReadData(self, maxread=None):
if self.read_eof:
return False
now = time.time()
maxread = maxread or self.maxread
flooded = self.Flooded(now)
if flooded > self.max_read_speed and not self.acked_kb_delta:
# FIXME: This is v1 flow control, kill it when 0.4.7 is "everywhere"
last = self.throttle_until
# Disable local throttling for really slow connections; remote
# throttles (trigged by blocked sockets) still work.
if self.max_read_speed > 1024:
self.AutoThrottle()
maxread = 1024
if now > last and self.all_in > 2*self.max_read_speed:
self.max_read_speed *= 1.25
self.max_read_speed += maxread
try:
if self.peeking:
data = self.fd.recv(maxread, socket.MSG_PEEK)
self.peeked = len(data)
if logging.DEBUG_IO:
print '<== PEEK =[%s]==(\n%s)==' % (self, data[:160])
else:
data = self.fd.recv(maxread)
if logging.DEBUG_IO:
print ('<== IN =[%s @ %dbps]==(\n%s)=='
) % (self, self.max_read_speed, data[:160])
except (SSL.WantReadError, SSL.WantWriteError), err:
return True
except IOError, err:
if err.errno not in self.HARMLESS_ERRNOS:
self.LogDebug('Error reading socket: %s (%s)' % (err, err.errno))
common.DISCONNECT_COUNT += 1
return False
else:
return True
except (SSL.Error, SSL.ZeroReturnError, SSL.SysCallError), err:
self.LogDebug('Error reading socket (SSL): %s' % err)
common.DISCONNECT_COUNT += 1
return False
except socket.error, (errno, msg):
if errno in self.HARMLESS_ERRNOS:
return True
else:
self.LogInfo('Error reading socket: %s (errno=%s)' % (msg, errno))
common.DISCONNECT_COUNT += 1
return False
self.last_activity = now
if data is None or data == '':
self.read_eof = True
if logging.DEBUG_IO:
print '<== IN =[%s]==(EOF)==' % self
return self.ProcessData('')
else:
if not self.peeking:
self.read_bytes += len(data)
if self.acked_kb_delta:
self.acked_kb_delta += (len(data)/1024)
if self.read_bytes > logging.LOG_THRESHOLD: self.LogTraffic()
return self.ProcessData(data)
def Flooded(self, now=None):
delta = ((now or time.time()) - self.created)
if delta >= 1:
flooded = self.read_bytes + self.all_in
flooded -= self.max_read_speed * 0.95 * delta
return flooded
else:
return 0
def RecordProgress(self, skb, bps):
if skb >= 0:
all_read = (self.all_in + self.read_bytes) / 1024
if self.acked_kb_delta:
self.acked_kb_delta = max(1, all_read - skb)
self.LogDebug('Delta is: %d' % self.acked_kb_delta)
elif bps >= 0:
self.Throttle(max_speed=bps, remote=True)
def Throttle(self, max_speed=None, remote=False, delay=0.2):
if max_speed:
self.max_read_speed = max_speed
flooded = max(-1, self.Flooded())
if self.max_read_speed:
delay = min(10, max(0.1, flooded/self.max_read_speed))
if flooded < 0: delay = 0
if delay:
ot = self.throttle_until
self.throttle_until = time.time() + delay
if ((self.throttle_until - ot) > 30 or
(int(ot) != int(self.throttle_until) and delay > 8)):
self.LogInfo('Throttled %.1fs until %x (flood=%d, bps=%s, %s)' % (
delay, self.throttle_until, flooded,
self.max_read_speed, remote and 'remote' or 'local'))
return True
def AutoThrottle(self, max_speed=None, remote=False, delay=0.2):
return self.Throttle(max_speed, remote, delay)
def Send(self, data, try_flush=False, activity=False,
just_buffer=False, allow_blocking=False):
self.write_speed = int((self.wrote_bytes + self.all_out)
/ max(1, (time.time() - self.created)))
# If we're already blocked, just buffer unless explicitly asked to flush.
if ((just_buffer) or
((not try_flush) and
(len(self.write_blocked) > 0 or compat.SEND_ALWAYS_BUFFERS))):
self.write_blocked += str(''.join(data))
return True
sending = ''.join([self.write_blocked, str(''.join(data))])
self.write_blocked = ''
sent_bytes = 0
if sending:
try:
want_send = self.write_retry or min(len(sending), SEND_MAX_BYTES)
sent_bytes = None
# Try to write for up to 5 seconds before giving up
for try_wait in (0, 0, 0.1, 0.2, 0.2, 0.2, 0.3, 0.5, 0.5, 1, 1, 1, 0):
try:
sent_bytes = self.fd.send(sending[:want_send])
if logging.DEBUG_IO:
print ('==> OUT =[%s: %d/%d bytes]==(\n%s)=='
) % (self, sent_bytes, want_send, sending[:min(160, sent_bytes)])
self.wrote_bytes += sent_bytes
self.write_retry = None
break
except (SSL.WantWriteError, SSL.WantReadError), err:
if logging.DEBUG_IO:
print '=== WRITE SSL RETRY: =[%s: %s bytes]==' % (self, want_send)
if try_wait:
time.sleep(try_wait)
if sent_bytes is None:
self.LogInfo('Error sending: Too many SSL write retries')
self.ProcessEofWrite()
common.DISCONNECT_COUNT += 1
return False
except IOError, err:
if err.errno not in self.HARMLESS_ERRNOS:
self.LogInfo('Error sending: %s' % err)
self.ProcessEofWrite()
common.DISCONNECT_COUNT += 1
return False
else:
if logging.DEBUG_IO:
print '=== WRITE HICCUP: =[%s: %s bytes]==' % (self, want_send)
self.write_retry = want_send
except socket.error, (errno, msg):
if errno not in self.HARMLESS_ERRNOS:
self.LogInfo('Error sending: %s (errno=%s)' % (msg, errno))
self.ProcessEofWrite()
common.DISCONNECT_COUNT += 1
return False
else:
if logging.DEBUG_IO:
print '=== WRITE HICCUP: =[%s: %s bytes]==' % (self, want_send)
self.write_retry = want_send
except (SSL.Error, SSL.ZeroReturnError, SSL.SysCallError), err:
self.LogInfo('Error sending (SSL): %s' % err)
self.ProcessEofWrite()
common.DISCONNECT_COUNT += 1
return False
except AttributeError:
# This has been seen in the wild, is most likely some sort of
# race during shutdown. :-(
self.LogInfo('AttributeError, self.fd=%s' % self.fd)
self.ProcessEofWrite()
return False
if activity:
self.last_activity = time.time()
self.write_blocked = sending[sent_bytes:]
if self.wrote_bytes >= logging.LOG_THRESHOLD:
self.LogTraffic()
if self.write_eof and not self.write_blocked:
self.ProcessEofWrite()
return True
def SendChunked(self, data, compress=True, zhistory=None, just_buffer=False):
rst = ''
if self.zreset:
self.zreset = False
rst = 'R'
# Stop compressing streams that just get bigger.
if zhistory and (zhistory[0] < zhistory[1]): compress = False
try:
try:
if self.lock:
self.lock.acquire()
sdata = ''.join(data)
if self.zw and compress and len(sdata) > 64:
try:
zdata = self.zw.compress(sdata) + self.zw.flush(zlib.Z_SYNC_FLUSH)
if zhistory:
zhistory[0] = len(sdata)
zhistory[1] = len(zdata)
return self.Send(['%xZ%x%s\r\n' % (len(sdata), len(zdata), rst), zdata],
activity=False,
try_flush=(not just_buffer), just_buffer=just_buffer)
except zlib.error:
logging.LogError('Error compressing, resetting ZChunks.')
self.ResetZChunks()
return self.Send(['%x%s\r\n' % (len(sdata), rst), sdata],
activity=False,
try_flush=(not just_buffer), just_buffer=just_buffer)
except UnicodeDecodeError:
logging.LogError('UnicodeDecodeError in SendChunked, wtf?')
return False
finally:
if self.lock:
self.lock.release()
def Flush(self, loops=50, wait=False, allow_blocking=False):
while (loops != 0 and
len(self.write_blocked) > 0 and
self.Send([], try_flush=True, activity=False,
allow_blocking=allow_blocking)):
if wait and len(self.write_blocked) > 0:
time.sleep(0.1)
logging.LogDebug('Flushing...')
loops -= 1
if self.write_blocked: return False
return True
def IsReadable(s, now):
return (s.fd and (not s.read_eof)
and (s.acked_kb_delta < 64) # FIXME
and (s.throttle_until <= now))
def IsBlocked(s):
return (s.fd and (len(s.write_blocked) > 0))
def IsDead(s):
return (s.read_eof and s.write_eof and not s.write_blocked)
def Die(self, discard_buffer=False):
if discard_buffer:
self.write_blocked = ''
self.read_eof = self.write_eof = True
return True
def HTTP_Unavail(self, config, where, proto, host, **kwargs):
kwargs['frame_url'] = config.error_url
if self.fd:
kwargs['relay_sockname'] = self.fd.getsockname()
# Do we have a more specific error URL for this domain? This is a
# white-label feature, for folks not wanting to hit the PageKite.net
# servers at all. In case of a match, we also disable mention of
# PageKite itself in the HTML boilerplate.
dparts = host.split('.')
while dparts:
fu = config.error_urls.get('.'.join(dparts), None)
if fu is not None:
kwargs['frame_url'] = fu
kwargs['advertise'] = False
break
dparts.pop(0)
return HTTP_Unavailable(where, proto, host, **kwargs)
class LineParser(Selectable):
"""A Selectable which parses the input as lines of text."""
def __init__(self, fd=None, address=None, on_port=None,
ui=None, tracked=True):
Selectable.__init__(self, fd, address, on_port, ui=ui, tracked=tracked)
self.leftovers = ''
def __html__(self):
return Selectable.__html__(self)
def Cleanup(self, close=True):
Selectable.Cleanup(self, close=close)
self.leftovers = ''
def ProcessData(self, data):
lines = (self.leftovers+data).splitlines(True)
self.leftovers = ''
while lines:
line = lines.pop(0)
if line.endswith('\n'):
if self.ProcessLine(line, lines) is False:
return False
else:
if not self.peeking: self.leftovers += line
if self.read_eof: return self.ProcessEofRead()
return True
def ProcessLine(self, line, lines):
self.LogError('LineParser::ProcessLine: Should be overridden!')
return False
TLS_CLIENTHELLO = '%c' % 026
SSL_CLIENTHELLO = '\x80'
MINECRAFT_HANDSHAKE = '%c' % (0x02, )
FLASH_POLICY_REQ = ''
# FIXME: XMPP support
class MagicProtocolParser(LineParser):
"""A Selectable which recognizes HTTP, TLS or XMPP preambles."""
def __init__(self, fd=None, address=None, on_port=None, ui=None):
LineParser.__init__(self, fd, address, on_port, ui=ui, tracked=False)
self.leftovers = ''
self.might_be_tls = True
self.is_tls = False
self.my_tls = False
def __html__(self):
return ('Detected TLS: %s '
'%s') % (self.is_tls,
LineParser.__html__(self))
# FIXME: DEPRECATE: Make this all go away, switch to CONNECT.
def ProcessMagic(self, data):
args = {}
try:
prefix, words, data = data.split('\r\n', 2)
for arg in words.split('; '):
key, val = arg.split('=', 1)
args[key] = val
self.EatPeeked(eat_bytes=len(prefix)+2+len(words)+2)
except ValueError, e:
return True
try:
port = 'port' in args and args['port'] or None
if port: self.on_port = int(port)
except ValueError, e:
return False
proto = 'proto' in args and args['proto'] or None
if proto in ('http', 'http2', 'http3', 'websocket'):
return LineParser.ProcessData(self, data)
domain = 'domain' in args and args['domain'] or None
if proto == 'https': return self.ProcessTls(data, domain)
if proto == 'raw' and domain: return self.ProcessProto(data, 'raw', domain)
return False
def ProcessData(self, data):
# Uncomment when adding support for new protocols:
#
#self.LogDebug(('DATA: >%s<'
# ) % ' '.join(['%2.2x' % ord(d) for d in data]))
if data.startswith(MAGIC_PREFIX):
return self.ProcessMagic(data)
if self.might_be_tls:
self.might_be_tls = False
if not (data.startswith(TLS_CLIENTHELLO) or
data.startswith(SSL_CLIENTHELLO)):
self.EatPeeked()
# FIXME: These only work if the full policy request or minecraft
# handshake are present in the first data packet.
if data.startswith(FLASH_POLICY_REQ):
return self.ProcessFlashPolicyRequest(data)
if data.startswith(MINECRAFT_HANDSHAKE):
user, server, port = self.GetMinecraftInfo(data)
if user and server:
return self.ProcessProto(data, 'minecraft', server)
return LineParser.ProcessData(self, data)
self.is_tls = True
if self.is_tls:
return self.ProcessTls(data)
else:
self.EatPeeked()
return LineParser.ProcessData(self, data)
def GetMsg(self, data):
mtype, ml24, mlen = struct.unpack('>BBH', data[0:4])
mlen += ml24 * 0x10000
return mtype, data[4:4+mlen], data[4+mlen:]
def GetClientHelloExtensions(self, msg):
# Ugh, so many magic numbers! These are accumulated sizes of
# the different fields we are ignoring in the TLS headers.
slen = struct.unpack('>B', msg[34])[0]
cslen = struct.unpack('>H', msg[35+slen:37+slen])[0]
cmlen = struct.unpack('>B', msg[37+slen+cslen])[0]
extofs = 34+1+2+1+2+slen+cslen+cmlen
if extofs < len(msg): return msg[extofs:]
return None
def GetSniNames(self, extensions):
names = []
while extensions:
etype, elen = struct.unpack('>HH', extensions[0:4])
if etype == 0:
# OK, we found an SNI extension, get the list.
namelist = extensions[6:4+elen]
while namelist:
ntype, nlen = struct.unpack('>BH', namelist[0:3])
if ntype == 0: names.append(namelist[3:3+nlen].lower())
namelist = namelist[3+nlen:]
extensions = extensions[4+elen:]
return names
def GetSni(self, data):
hello, vmajor, vminor, mlen = struct.unpack('>BBBH', data[0:5])
data = data[5:]
sni = []
while data:
mtype, msg, data = self.GetMsg(data)
if mtype == 1:
# ClientHello!
sni.extend(self.GetSniNames(self.GetClientHelloExtensions(msg)))
return sni
def GetMinecraftInfo(self, data):
try:
(packet, version, unlen) = struct.unpack('>bbh', data[0:4])
unlen *= 2
(hnlen, ) = struct.unpack('>h', data[4+unlen:6+unlen])
hnlen *= 2
(port, ) = struct.unpack('>i', data[6+unlen+hnlen:10+unlen+hnlen])
uname = data[4:4+unlen].decode('utf_16_be').encode('utf-8')
sname = data[6+unlen:6+hnlen+unlen].decode('utf_16_be').encode('utf-8')
return uname, sname, port
except:
return None, None, None
def ProcessFlashPolicyRequest(self, data):
self.LogError('MagicProtocolParser::ProcessFlashPolicyRequest: Should be overridden!')
return False
def ProcessTls(self, data, domain=None):
self.LogError('MagicProtocolParser::ProcessTls: Should be overridden!')
return False
def ProcessProto(self, data, proto, domain):
self.LogError('MagicProtocolParser::ProcessProto: Should be overridden!')
return False
class ChunkParser(Selectable):
"""A Selectable which parses the input as chunks."""
def __init__(self, fd=None, address=None, on_port=None, ui=None):
Selectable.__init__(self, fd, address, on_port, ui=ui)
self.want_cbytes = 0
self.want_bytes = 0
self.compressed = False
self.header = ''
self.chunk = ''
self.zr = zlib.decompressobj()
def __html__(self):
return Selectable.__html__(self)
def Cleanup(self, close=True):
Selectable.Cleanup(self, close=close)
self.zr = self.chunk = self.header = None
def ProcessData(self, data):
loops = 1500
result = more = True
while result and more and (loops > 0):
loops -= 1
if self.peeking:
self.want_cbytes = 0
self.want_bytes = 0
self.header = ''
self.chunk = ''
if self.want_bytes == 0:
self.header += (data or '')
if self.header.find('\r\n') < 0:
if self.read_eof:
return self.ProcessEofRead()
return True
try:
size, data = self.header.split('\r\n', 1)
self.header = ''
if size.endswith('R'):
self.zr = zlib.decompressobj()
size = size[0:-1]
if 'Z' in size:
csize, zsize = size.split('Z')
self.compressed = True
self.want_cbytes = int(csize, 16)
self.want_bytes = int(zsize, 16)
else:
self.compressed = False
self.want_bytes = int(size, 16)
except ValueError, err:
self.LogError('ChunkParser::ProcessData: %s' % err)
self.Log([('bad_data', data)])
return False
if self.want_bytes == 0:
return False
process = data[:self.want_bytes]
data = more = data[self.want_bytes:]
self.chunk += process
self.want_bytes -= len(process)
if self.want_bytes == 0:
if self.compressed:
try:
cchunk = self.zr.decompress(self.chunk)
except zlib.error:
cchunk = ''
if len(cchunk) != self.want_cbytes:
result = self.ProcessCorruptChunk(self.chunk)
else:
result = self.ProcessChunk(cchunk)
else:
result = self.ProcessChunk(self.chunk)
self.chunk = ''
if result and more:
self.LogError('Unprocessed data: %s' % data)
raise BugFoundError('Too much data')
elif self.read_eof:
return self.ProcessEofRead() and result
else:
return result
def ProcessCorruptChunk(self, chunk):
self.LogError('ChunkParser::ProcessData: ProcessCorruptChunk not overridden!')
return False
def ProcessChunk(self, chunk):
self.LogError('ChunkParser::ProcessData: ProcessChunk not overridden!')
return False
pagekite-0.5.9.3/pagekite/__init__.py 0000755 0000000 0000000 00000001635 13232067545 017336 0 ustar root root 0000000 0000000 ##############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
##############################################################################
pagekite-0.5.9.3/pagekite/ui/ 0000755 0000000 0000000 00000000000 13232067643 015631 5 ustar root root 0000000 0000000 pagekite-0.5.9.3/pagekite/ui/basic.py 0000755 0000000 0000000 00000022546 13232067545 017301 0 ustar root root 0000000 0000000 """
This is the "basic" text-mode user interface class.
"""
#############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
#############################################################################
import re
import sys
import time
from nullui import NullUi
from pagekite.common import *
HTML_BR_RE = re.compile(r'<(br|/p|/li|/tr|/h\d)>\s*')
HTML_LI_RE = re.compile(r'
\s*')
HTML_NBSP_RE = re.compile(r' ')
HTML_TAGS_RE = re.compile(r'<[^>\s][^>]*>')
def clean_html(text):
return HTML_LI_RE.sub(' * ',
HTML_NBSP_RE.sub('_',
HTML_BR_RE.sub('\n', text)))
def Q(text):
return HTML_TAGS_RE.sub('', clean_html(text))
class BasicUi(NullUi):
"""Stdio based user interface."""
DAEMON_FRIENDLY = False
WANTS_STDERR = True
EMAIL_RE = re.compile(r'^[a-z0-9!#$%&\'\*\+\/=?^_`{|}~-]+'
'(?:\.[a-z0-9!#$%&\'*+/=?^_`{|}~-]+)*@'
'(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)*'
'(?:[a-zA-Z]{2,16})$')
def Notify(self, message, prefix=' ',
popup=False, color=None, now=None, alignright=''):
now = int(now or time.time())
color = color or self.NORM
# We suppress duplicates that are either new or still on the screen.
keys = self.notify_history.keys()
if len(keys) > 20:
for key in keys:
if self.notify_history[key] < now-300:
del self.notify_history[key]
message = '%s' % message
if message not in self.notify_history:
# Display the time now and then.
if (not alignright and
(now >= (self.last_tick + 60)) and
(len(message) < 68)):
try:
self.last_tick = now
d = datetime.datetime.fromtimestamp(now)
alignright = '[%2.2d:%2.2d]' % (d.hour, d.minute)
except:
pass # Fails on Python 2.2
if not now or now > 0:
self.notify_history[message] = now
msg = '\r%s %s%s%s%s%s\n' % ((prefix * 3)[0:3], color, message, self.NORM,
' ' * (75-len(message)-len(alignright)),
alignright)
self.wfile.write(msg)
self.Status(self.status_tag, self.status_msg)
def NotifyMOTD(self, frontend, motd_message):
lc = 1
self.Notify(' ')
for line in Q(motd_message).splitlines():
self.Notify((line.strip() or ' ' * (lc+2)),
prefix=' ++', color=self.WHITE)
lc += 1
self.Notify(' ' * (lc+2), alignright='[MOTD from %s]' % frontend)
self.Notify(' ')
def Status(self, tag, message=None, color=None):
self.status_tag = tag
self.status_col = color or self.status_col or self.NORM
self.status_msg = '%s' % (message or self.status_msg)
if not self.in_wizard:
message = self.status_msg
msg = ('\r << pagekite.py [%s]%s %s%s%s\r%s'
) % (tag, ' ' * (8-len(tag)),
self.status_col, message[:52],
' ' * (52-len(message)), self.NORM)
self.wfile.write(msg)
if tag == 'exiting':
self.wfile.write('\n')
def Welcome(self, pre=None):
if self.in_wizard:
self.wfile.write('%s%s%s' % (self.CLEAR, self.WHITE, self.in_wizard))
if self.welcome:
self.wfile.write('%s\r%s\n' % (self.NORM, Q(self.welcome)))
self.welcome = None
if self.in_wizard and self.wizard_tell:
self.wfile.write('\n%s\r' % self.NORM)
for line in self.wizard_tell: self.wfile.write('*** %s\n' % Q(line))
self.wizard_tell = None
if pre:
self.wfile.write('\n%s\r' % self.NORM)
for line in pre: self.wfile.write(' %s\n' % Q(line))
self.wfile.write('\n%s\r' % self.NORM)
def StartWizard(self, title):
self.Welcome()
banner = '>>> %s' % title
banner = ('%s%s[CTRL+C = Cancel]\n') % (banner, ' ' * (62-len(banner)))
self.in_wizard = banner
self.tries = 200
def Retry(self):
self.tries -= 1
return self.tries
def EndWizard(self, quietly=False):
if self.wizard_tell:
self.Welcome()
self.in_wizard = None
if sys.platform in ('win32', 'os2', 'os2emx') and not quietly:
self.wfile.write('\n<<< press ENTER to continue >>>\n')
self.rfile.readline()
def Spacer(self):
self.wfile.write('\n')
def Readline(self):
line = self.rfile.readline()
if line:
return line.strip()
else:
raise IOError('EOF')
def AskEmail(self, question, default=None, pre=[],
wizard_hint=False, image=None, back=None, welcome=True):
if welcome: self.Welcome(pre)
while self.Retry():
self.wfile.write(' => %s ' % (Q(question), ))
answer = self.Readline()
if default and answer == '': return default
if self.EMAIL_RE.match(answer.lower()): return answer
if back is not None and answer == 'back': return back
raise Exception('Too many tries')
def AskLogin(self, question, default=None, email=None, pre=None,
wizard_hint=False, image=None, back=None):
self.Welcome(pre)
def_email, def_pass = default or (email, None)
self.wfile.write(' %s\n' % (Q(question), ))
if not email:
email = self.AskEmail('Your e-mail:',
default=def_email, back=back, welcome=False)
if email == back: return back
import getpass
self.wfile.write(' => ')
return (email, getpass.getpass() or def_pass)
def AskYesNo(self, question, default=None, pre=[], yes='yes', no='no',
wizard_hint=False, image=None, back=None):
self.Welcome(pre)
yn = ((default is True) and '[Y/n]'
) or ((default is False) and '[y/N]'
) or ('[y/n]')
while self.Retry():
self.wfile.write(' => %s %s ' % (Q(question), yn))
answer = self.Readline().lower()
if default is not None and answer == '': answer = default and 'y' or 'n'
if back is not None and answer.startswith('b'): return back
if answer in ('y', 'n'): return (answer == 'y')
raise Exception('Too many tries')
def AskQuestion(self, question, pre=[], default=None, prompt=' =>',
wizard_hint=False, image=None, back=None):
self.Welcome(pre)
self.wfile.write('%s %s ' % (prompt, Q(question)))
return self.Readline()
def AskKiteName(self, domains, question, pre=[], default=None,
wizard_hint=False, image=None, back=None):
self.Welcome(pre)
if len(domains) == 1:
self.wfile.write(('\n (Note: the ending %s will be added for you.)'
) % domains[0])
else:
self.wfile.write('\n Please use one of the following domains:\n')
for domain in domains:
self.wfile.write('\n *%s' % domain)
self.wfile.write('\n')
while self.Retry():
self.wfile.write('\n => %s ' % Q(question))
answer = self.Readline().lower()
if back is not None and answer == 'back':
return back
elif len(domains) == 1:
answer = answer.replace(domains[0], '')
if answer and SERVICE_SUBDOMAIN_RE.match(answer):
return answer+domains[0]
else:
for domain in domains:
if answer.endswith(domain):
answer = answer.replace(domain, '')
if answer and SERVICE_SUBDOMAIN_RE.match(answer):
return answer+domain
self.wfile.write(' (Please only use characters A-Z, 0-9, - and _.)')
raise Exception('Too many tries')
def AskMultipleChoice(self, choices, question, pre=[], default=None,
wizard_hint=False, image=None, back=None):
self.Welcome(pre)
for i in range(0, len(choices)):
self.wfile.write((' %s %d) %s\n'
) % ((default==i+1) and '*' or ' ', i+1, choices[i]))
self.wfile.write('\n')
while self.Retry():
d = default and (', default=%d' % default) or ''
self.wfile.write(' => %s [1-%d%s] ' % (Q(question), len(choices), d))
try:
answer = self.Readline().strip()
if back is not None and answer.startswith('b'): return back
choice = int(answer or default)
if choice > 0 and choice <= len(choices): return choice
except (ValueError, IndexError):
pass
raise Exception('Too many tries')
def Tell(self, lines, error=False, back=None):
if self.in_wizard:
self.wizard_tell = lines
else:
self.Welcome()
for line in lines: self.wfile.write(' %s\n' % line)
if error: self.wfile.write('\n')
return True
def Working(self, message):
if self.in_wizard:
pending_messages = self.wizard_tell or []
self.wizard_tell = pending_messages + [message+' ...']
self.Welcome()
self.wizard_tell = pending_messages + [message+' ... done.']
else:
self.Tell([message])
return True
pagekite-0.5.9.3/pagekite/ui/nullui.py 0000755 0000000 0000000 00000022320 13232067545 017516 0 ustar root root 0000000 0000000 """
This is a basic "Null" user interface which does nothing at all.
"""
##############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
##############################################################################
import sys
from pagekite.compat import *
from pagekite.common import *
import pagekite.logging as logging
class NullUi(object):
"""This is a UI that always returns default values or raises errors."""
DAEMON_FRIENDLY = True
ALLOWS_INPUT = False
WANTS_STDERR = False
REJECTED_REASONS = {
'quota': 'You are out of quota',
'nodays': 'Your subscription has expired',
'noquota': 'You are out of quota',
'noconns': 'You are flying too many kites',
'unauthorized': 'Invalid account or shared secret'
}
def __init__(self, welcome=None, wfile=sys.stderr, rfile=sys.stdin):
if sys.platform[:3] in ('win', 'os2'):
self.CLEAR = '\n\n%s\n\n' % ('=' * 79)
self.NORM = self.WHITE = self.GREY = self.GREEN = self.YELLOW = ''
self.BLUE = self.RED = self.MAGENTA = self.CYAN = ''
else:
self.CLEAR = '\033[H\033[J'
self.NORM = '\033[0m'
self.WHITE = '\033[1m'
self.GREY = '\033[0m' #'\033[30;1m'
self.RED = '\033[31;1m'
self.GREEN = '\033[32;1m'
self.YELLOW = '\033[33;1m'
self.BLUE = '\033[34;1m'
self.MAGENTA = '\033[35;1m'
self.CYAN = '\033[36;1m'
self.wfile = wfile
self.rfile = rfile
self.welcome = welcome
self.Reset()
self.Splash()
def Reset(self):
self.in_wizard = False
self.wizard_tell = None
self.last_tick = 0
self.notify_history = {}
self.status_tag = ''
self.status_col = self.NORM
self.status_msg = ''
self.tries = 200
self.server_info = None
def Splash(self): pass
def Welcome(self): pass
def StartWizard(self, title): pass
def EndWizard(self, quietly=False): pass
def Spacer(self): pass
def Browse(self, url):
import webbrowser
self.Tell(['Opening %s in your browser...' % url])
webbrowser.open(url)
def DefaultOrFail(self, question, default):
if default is not None: return default
raise ConfigError('Unanswerable question: %s' % question)
def AskLogin(self, question, default=None, email=None,
wizard_hint=False, image=None, back=None):
return self.DefaultOrFail(question, default)
def AskEmail(self, question, default=None, pre=None,
wizard_hint=False, image=None, back=None):
return self.DefaultOrFail(question, default)
def AskYesNo(self, question, default=None, pre=None, yes='Yes', no='No',
wizard_hint=False, image=None, back=None):
return self.DefaultOrFail(question, default)
def AskQuestion(self, question, pre=[], default=None, prompt=None,
wizard_hint=False, image=None, back=None):
return self.DefaultOrFail(question, default)
def AskKiteName(self, domains, question, pre=[], default=None,
wizard_hint=False, image=None, back=None):
return self.DefaultOrFail(question, default)
def AskMultipleChoice(self, choices, question, pre=[], default=None,
wizard_hint=False, image=None, back=None):
return self.DefaultOrFail(question, default)
def AskBackends(self, kitename, protos, ports, rawports, question, pre=[],
default=None, wizard_hint=False, image=None, back=None):
return self.DefaultOrFail(question, default)
def Working(self, message): pass
def Tell(self, lines, error=False, back=None):
if error:
logging.LogError(' '.join(lines))
raise ConfigError(' '.join(lines))
else:
logging.Log([('message', ' '.join(lines))])
return True
def Notify(self, message, prefix=' ',
popup=False, color=None, now=None, alignright=''):
if popup: logging.Log([('info', '%s%s%s' % (message,
alignright and ' ' or '',
alignright))])
def NotifyMOTD(self, frontend, message):
pass
def NotifyKiteRejected(self, proto, domain, reason, crit=False):
if reason in self.REJECTED_REASONS:
reason = self.REJECTED_REASONS[reason]
self.Notify('REJECTED: %s:%s (%s)' % (proto, domain, reason),
prefix='!', color=(crit and self.RED or self.YELLOW))
def NotifyList(self, prefix, items, color):
items = items[:]
while items:
show = []
while items and len(prefix) + len(' '.join(show)) < 65:
show.append(items.pop(0))
self.Notify(' - %s: %s' % (prefix, ' '.join(show)), color=color)
def NotifyServer(self, obj, server_info):
self.server_info = server_info
self.Notify('Connecting to front-end relay %s ...' % server_info[obj.S_NAME],
color=self.GREY)
self.NotifyList('Protocols', server_info[obj.S_PROTOS], self.GREY)
self.NotifyList('Ports', server_info[obj.S_PORTS], self.GREY)
if 'raw' in server_info[obj.S_PROTOS]:
self.NotifyList('Raw ports', server_info[obj.S_RAW_PORTS], self.GREY)
def NotifyQuota(self, quota, q_days, q_conns):
qMB = 1024
msg = 'Quota: You have %.2f MB' % (float(quota) / qMB)
if q_days is not None: msg += ', %d days' % q_days
if q_conns is not None: msg += ' and %d connections' % q_conns
self.Notify(msg + ' left.',
prefix=(int(quota) < qMB) and '!' or ' ',
color=self.MAGENTA)
def NotifyFlyingFE(self, proto, port, domain, be=None):
self.Notify(('Flying: %s://%s%s/'
) % (proto, domain, port and ':'+port or ''),
prefix='~<>', color=self.CYAN)
def StartListingBackEnds(self): pass
def EndListingBackEnds(self): pass
def NotifyBE(self, bid, be, has_ssl, dpaths,
is_builtin=False, fingerprint=None):
domain, port, proto = be[BE_DOMAIN], be[BE_PORT], be[BE_PROTO]
prox = (proto == 'raw') and ' (HTTP proxied)' or ''
if proto == 'raw' and port in ('22', 22): proto = 'ssh'
if has_ssl and proto == 'http':
proto = 'https'
url = '%s://%s%s' % (proto, domain, port and (':%s' % port) or '')
if be[BE_STATUS] == BE_STATUS_UNKNOWN: return
if be[BE_STATUS] & BE_STATUS_OK:
if be[BE_STATUS] & BE_STATUS_ERR_ANY:
status = 'Trying'
color = self.YELLOW
prefix = ' '
else:
status = 'Flying'
color = self.CYAN
prefix = '~<>'
else:
return
if is_builtin:
backend = 'builtin HTTPD'
else:
backend = '%s:%s' % (be[BE_BHOST], be[BE_BPORT])
self.Notify(('%s %s as %s/%s'
) % (status, backend, url, prox),
prefix=prefix, color=color)
if status == 'Flying':
for dp in sorted(dpaths.keys()):
self.Notify(' - %s%s' % (url, dp), color=self.BLUE)
if fingerprint and proto.startswith('https'):
self.Notify(' - Fingerprint=%s' % fingerprint,
color=self.WHITE)
self.Notify((' IMPORTANT: For maximum security, use a secure channel'
' to inform your'),
color=self.YELLOW)
self.Notify(' guests what fingerprint to expect.',
color=self.YELLOW)
def Status(self, tag, message=None, color=None): pass
def ExplainError(self, error, title, subject=None):
if error == 'pleaselogin':
self.Tell([title, '', 'You already have an account. Log in to continue.'
], error=True)
elif error == 'email':
self.Tell([title, '', 'Invalid e-mail address. Please try again?'
], error=True)
elif error == 'honey':
self.Tell([title, '', 'Hmm. Somehow, you triggered the spam-filter.'
], error=True)
elif error in ('domaintaken', 'domain', 'subdomain'):
self.Tell([title, '',
'Sorry, that domain (%s) is unavailable.' % subject,
'',
'If you registered it already, perhaps you need to log on with',
'a different e-mail address?',
''
], error=True)
elif error == 'checkfailed':
self.Tell([title, '',
'That domain (%s) is not correctly set up.' % subject
], error=True)
elif error == 'network':
self.Tell([title, '',
'There was a problem communicating with %s.' % subject, '',
'Please verify that you have a working'
' Internet connection and try again!'
], error=True)
else:
self.Tell([title, 'Error code: %s' % error, 'Try again later?'
], error=True)
pagekite-0.5.9.3/pagekite/ui/remote.py 0000755 0000000 0000000 00000035565 13232067545 017520 0 ustar root root 0000000 0000000 """
This is a user interface class which communicates over a pipe or socket.
"""
##############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
##############################################################################
import re
import sys
import time
import threading
from pagekite.compat import *
from pagekite.common import *
from pagekite.proto.conns import Tunnel
from nullui import NullUi
class RemoteUi(NullUi):
"""Stdio based user interface for interacting with other processes."""
DAEMON_FRIENDLY = True
ALLOWS_INPUT = True
WANTS_STDERR = True
EMAIL_RE = re.compile(r'^[a-z0-9!#$%&\'\*\+\/=?^_`{|}~-]+'
'(?:\.[a-z0-9!#$%&\'*+/=?^_`{|}~-]+)*@'
'(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)*'
'(?:[a-zA-Z]{2,4}|museum)$')
def __init__(self, welcome=None, wfile=sys.stderr, rfile=sys.stdin):
NullUi.__init__(self, welcome=welcome, wfile=wfile, rfile=rfile)
self.CLEAR = ''
self.NORM = self.WHITE = self.GREY = self.GREEN = self.YELLOW = ''
self.BLUE = self.RED = self.MAGENTA = self.CYAN = ''
def StartListingBackEnds(self):
self.wfile.write('begin_be_list\n')
def EndListingBackEnds(self):
self.wfile.write('end_be_list\n')
def NotifyBE(self, bid, be, has_ssl, dpaths,
is_builtin=False, fingerprint=None, now=None):
domain = be[BE_DOMAIN]
port = be[BE_PORT]
proto = be[BE_PROTO]
prox = (proto == 'raw') and ' (HTTP proxied)' or ''
if proto == 'raw' and port in ('22', 22): proto = 'ssh'
url = '%s://%s%s' % (proto, domain, port and (':%s' % port) or '')
message = (' be_status:'
' status=%x; bid=%s; domain=%s; port=%s; proto=%s;'
' bhost=%s; bport=%s%s%s%s'
'\n') % (be[BE_STATUS], bid, domain, port, proto,
be[BE_BHOST], be[BE_BPORT],
has_ssl and '; ssl=1' or '',
is_builtin and '; builtin=1' or '',
fingerprint and ('; fingerprint=%s' % fingerprint) or '')
self.wfile.write(message)
for path in dpaths:
message = (' be_path: domain=%s; port=%s; path=%s; policy=%s; src=%s\n'
) % (domain, port or 80, path,
dpaths[path][0], dpaths[path][1])
self.wfile.write(message)
def Notify(self, message, prefix=' ',
popup=False, color=None, now=None, alignright=''):
message = '%s' % message
self.wfile.write('notify: %s\n' % message)
def NotifyMOTD(self, frontend, message):
self.wfile.write('motd: %s %s\n' % (frontend,
message.replace('\n', ' ')))
def Status(self, tag, message=None, color=None):
self.status_tag = tag
self.status_msg = '%s' % (message or self.status_msg)
if message:
self.wfile.write('status_msg: %s\n' % message)
if tag:
self.wfile.write('status_tag: %s\n' % tag)
def Welcome(self, pre=None):
self.wfile.write('welcome: %s\n' % (pre or '').replace('\n', ' '))
def StartWizard(self, title):
self.wfile.write('start_wizard: %s\n' % title)
def Retry(self):
self.tries -= 1
if self.tries < 0:
raise Exception('Too many tries')
return self.tries
def EndWizard(self, quietly=False):
self.wfile.write('end_wizard: %s\n' % (quietly and 'quietly' or 'done'))
def Spacer(self):
pass
def AskEmail(self, question, default=None, pre=[],
wizard_hint=False, image=None, back=None, welcome=True):
while self.Retry():
self.wfile.write('begin_ask_email\n')
if pre:
self.wfile.write(' preamble: %s\n' % '\n'.join(pre).replace('\n', ' '))
if default:
self.wfile.write(' default: %s\n' % default)
self.wfile.write(' question: %s\n' % (question or '').replace('\n', ' '))
self.wfile.write(' expect: email\n')
self.wfile.write('end_ask_email\n')
answer = self.rfile.readline().strip()
if self.EMAIL_RE.match(answer): return answer
if back is not None and answer == 'back': return back
def AskLogin(self, question, default=None, email=None, pre=None,
wizard_hint=False, image=None, back=None):
while self.Retry():
self.wfile.write('begin_ask_login\n')
if pre:
self.wfile.write(' preamble: %s\n' % '\n'.join(pre).replace('\n', ' '))
if email:
self.wfile.write(' default: %s\n' % email)
self.wfile.write(' question: %s\n' % (question or '').replace('\n', ' '))
self.wfile.write(' expect: email\n')
self.wfile.write(' expect: password\n')
self.wfile.write('end_ask_login\n')
answer_email = self.rfile.readline().strip()
if back is not None and answer_email == 'back': return back
answer_pass = self.rfile.readline().strip()
if back is not None and answer_pass == 'back': return back
if self.EMAIL_RE.match(answer_email) and answer_pass:
return (answer_email, answer_pass)
def AskYesNo(self, question, default=None, pre=[], yes='Yes', no='No',
wizard_hint=False, image=None, back=None):
while self.Retry():
self.wfile.write('begin_ask_yesno\n')
if yes:
self.wfile.write(' yes: %s\n' % yes)
if no:
self.wfile.write(' no: %s\n' % no)
if pre:
self.wfile.write(' preamble: %s\n' % '\n'.join(pre).replace('\n', ' '))
if default:
self.wfile.write(' default: %s\n' % default)
self.wfile.write(' question: %s\n' % (question or '').replace('\n', ' '))
self.wfile.write(' expect: yesno\n')
self.wfile.write('end_ask_yesno\n')
answer = self.rfile.readline().strip().lower()
if back is not None and answer == 'back': return back
if answer in ('y', 'n'): return (answer == 'y')
if answer == str(default).lower(): return default
def AskKiteName(self, domains, question, pre=[], default=None,
wizard_hint=False, image=None, back=None):
while self.Retry():
self.wfile.write('begin_ask_kitename\n')
if pre:
self.wfile.write(' preamble: %s\n' % '\n'.join(pre).replace('\n', ' '))
for domain in domains:
self.wfile.write(' domain: %s\n' % domain)
if default:
self.wfile.write(' default: %s\n' % default)
self.wfile.write(' question: %s\n' % (question or '').replace('\n', ' '))
self.wfile.write(' expect: kitename\n')
self.wfile.write('end_ask_kitename\n')
answer = self.rfile.readline().strip().lower()
if back is not None and answer == 'back': return back
if answer:
for d in domains:
if answer.endswith(d) or answer.endswith(d): return answer
return answer+domains[0]
def AskBackends(self, kitename, protos, ports, rawports, question, pre=[],
default=None, wizard_hint=False, image=None, back=None):
while self.Retry():
self.wfile.write('begin_ask_backends\n')
if pre:
self.wfile.write(' preamble: %s\n' % '\n'.join(pre).replace('\n', ' '))
count = 0
if self.server_info:
protos = self.server_info[Tunnel.S_PROTOS]
ports = self.server_info[Tunnel.S_PORTS]
rawports = self.server_info[Tunnel.S_RAW_PORTS]
self.wfile.write(' kitename: %s\n' % kitename)
self.wfile.write(' protos: %s\n' % ', '.join(protos))
self.wfile.write(' ports: %s\n' % ', '.join(ports))
self.wfile.write(' rawports: %s\n' % ', '.join(rawports))
if default:
self.wfile.write(' default: %s\n' % default)
self.wfile.write(' question: %s\n' % (question or '').replace('\n', ' '))
self.wfile.write(' expect: backends\n')
self.wfile.write('end_ask_backends\n')
answer = self.rfile.readline().strip().lower()
if back is not None and answer == 'back': return back
return answer
def AskMultipleChoice(self, choices, question, pre=[], default=None,
wizard_hint=False, image=None, back=None):
while self.Retry():
self.wfile.write('begin_ask_multiplechoice\n')
if pre:
self.wfile.write(' preamble: %s\n' % '\n'.join(pre).replace('\n', ' '))
count = 0
for choice in choices:
count += 1
self.wfile.write(' choice_%d: %s\n' % (count, choice))
if default:
self.wfile.write(' default: %s\n' % default)
self.wfile.write(' question: %s\n' % (question or '').replace('\n', ' '))
self.wfile.write(' expect: choice_index\n')
self.wfile.write('end_ask_multiplechoice\n')
answer = self.rfile.readline().strip().lower()
try:
ch = int(answer)
if ch > 0 and ch <= len(choices): return ch
except:
pass
if back is not None and answer == 'back': return back
def Tell(self, lines, error=False, back=None):
dialog = error and 'error' or 'message'
self.wfile.write('tell_%s: %s\n' % (dialog, ' '.join(lines)))
def Working(self, message):
self.wfile.write('working: %s\n' % message)
class PageKiteThread(threading.Thread):
def __init__(self, startup_args=None, debug=False):
threading.Thread.__init__(self)
self.pk = None
self.pk_readlock = threading.Condition()
self.gui_readlock = threading.Condition()
self.debug = debug
self.reset()
def reset(self):
self.pk_incoming = []
self.pk_eof = False
self.gui_incoming = ''
self.gui_eof = False
# These routines are used by the PageKite UI, to communicate with us...
def readline(self):
try:
self.pk_readlock.acquire()
while (not self.pk_incoming) and (not self.pk_eof): self.pk_readlock.wait()
if self.pk_incoming:
line = self.pk_incoming.pop(0)
else:
line = ''
if self.debug:
print '>>PK>> %s' % line.strip()
return line
finally:
self.pk_readlock.release()
def write(self, data):
if self.debug:
print '>>GUI>> %s' % data.strip()
try:
self.gui_readlock.acquire()
if data:
self.gui_incoming += data
else:
self.gui_eof = True
self.gui_readlock.notify()
finally:
self.gui_readlock.release()
# And these are used by the GUI, to communicate with PageKite.
def recv(self, bytecount):
try:
self.gui_readlock.acquire()
while (len(self.gui_incoming) < bytecount) and (not self.gui_eof):
self.gui_readlock.wait()
data = self.gui_incoming[0:bytecount]
self.gui_incoming = self.gui_incoming[bytecount:]
return data
finally:
self.gui_readlock.release()
def send(self, data):
if not data.endswith('\n') and data != '':
raise ValueError('Please always send whole lines')
if self.debug:
print '<
"""
##############################################################################
import common
from common import *
# System logging on Unix
try:
import syslog
except ImportError:
class mockSyslog:
def openlog(*args): raise ConfigError('No Syslog on this machine')
def syslog(*args): raise ConfigError('No Syslog on this machine')
LOG_DAEMON = 0
LOG_DEBUG = 0
LOG_ERROR = 0
LOG_PID = 0
syslog = mockSyslog()
# Backwards compatibility for old Pythons.
import socket
rawsocket = socket.socket
if not 'SHUT_RD' in dir(socket):
socket.SHUT_RD = 0
socket.SHUT_WR = 1
socket.SHUT_RDWR = 2
try:
import datetime
ts_to_date = datetime.datetime.fromtimestamp
def ts_to_iso(ts=None):
return datetime.datetime.fromtimestamp(ts).isoformat()
except ImportError:
ts_to_date = str
ts_to_iso = str
try:
sorted([1, 2, 3])
except:
def sorted(l):
tmp = l[:]
tmp.sort()
return tmp
try:
sum([1, 2, 3])
except:
def sum(l):
s = 0
for v in l:
s += v
return s
try:
from urlparse import parse_qs, urlparse
except ImportError, e:
from cgi import parse_qs
from urlparse import urlparse
try:
import hashlib
def sha1hex(data):
hl = hashlib.sha1()
hl.update(data)
return hl.hexdigest().lower()
except ImportError:
import sha
def sha1hex(data):
return sha.new(data).hexdigest().lower()
common.MAGIC_UUID = sha1hex(common.MAGIC_UUID)
try:
from traceback import format_exc
except ImportError:
import traceback
import StringIO
def format_exc():
sio = StringIO.StringIO()
traceback.print_exc(file=sio)
return sio.getvalue()
# Old Pythons lack rsplit
def rsplit(ch, data):
parts = data.split(ch)
if (len(parts) > 2):
tail = parts.pop(-1)
return (ch.join(parts), tail)
else:
return parts
# SSL/TLS strategy: prefer pyOpenSSL, as it comes with built-in Context
# objects. If that fails, look for Python 2.6+ native ssl support and
# create a compatibility wrapper. If both fail, bomb with a ConfigError
# when the user tries to enable anything SSL-related.
#
import sockschain
socks = sockschain
if socks.HAVE_PYOPENSSL:
SSL = socks.SSL
SEND_ALWAYS_BUFFERS = False
SEND_MAX_BYTES = 16 * 1024
TUNNEL_SOCKET_BLOCKS = False
elif socks.HAVE_SSL:
SSL = socks.SSL
SEND_ALWAYS_BUFFERS = True
SEND_MAX_BYTES = 4 * 1024
TUNNEL_SOCKET_BLOCKS = True # Workaround for http://bugs.python.org/issue8240
else:
SEND_ALWAYS_BUFFERS = False
SEND_MAX_BYTES = 16 * 1024
TUNNEL_SOCKET_BLOCKS = False
class SSL(object):
TLSv1_METHOD = 0
SSLv23_METHOD = 0
class Error(Exception): pass
class SysCallError(Exception): pass
class WantReadError(Exception): pass
class WantWriteError(Exception): pass
class ZeroReturnError(Exception): pass
class Context(object):
def __init__(self, method):
raise ConfigError('Neither pyOpenSSL nor python 2.6+ '
'ssl modules found!')
pagekite-0.5.9.3/pagekite/httpd.py 0000755 0000000 0000000 00000107271 13232067545 016725 0 ustar root root 0000000 0000000 """
This is the pagekite.py built-in HTTP server.
"""
##############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
##############################################################################
import base64
import cgi
from cgi import escape as escape_html
import os
import re
import socket
import sys
import tempfile
import threading
import time
import traceback
import urllib
import SocketServer
from CGIHTTPServer import CGIHTTPRequestHandler
from SimpleXMLRPCServer import SimpleXMLRPCServer, SimpleXMLRPCRequestHandler
import Cookie
from pagekite.common import *
from pagekite.compat import *
import pagekite.common as common
import pagekite.logging as logging
import pagekite.proto.selectables as selectables
import sockschain as socks
##[ Conditional imports & compatibility magic! ]###############################
try:
import datetime
ts_to_date = datetime.datetime.fromtimestamp
except ImportError:
ts_to_date = str
try:
sorted([1, 2, 3])
except:
def sorted(l):
tmp = l[:]
tmp.sort()
return tmp
# Different Python 2.x versions complain about deprecation depending on
# where we pull these from.
try:
from urlparse import parse_qs, urlparse
except ImportError, e:
from cgi import parse_qs
from urlparse import urlparse
try:
import hashlib
def sha1hex(data):
hl = hashlib.sha1()
hl.update(data)
return hl.hexdigest().lower()
except ImportError:
import sha
def sha1hex(data):
return sha.new(data).hexdigest().lower()
##[ PageKite HTTPD code starts here! ]#########################################
class AuthError(Exception):
pass
def fmt_size(count):
if count > 2*(1024*1024*1024):
return '%dGB' % (count / (1024*1024*1024))
if count > 2*(1024*1024):
return '%dMB' % (count / (1024*1024))
if count > 2*(1024):
return '%dKB' % (count / 1024)
return '%dB' % count
class CGIWrapper(CGIHTTPRequestHandler):
def __init__(self, request, path_cgi):
self.path = path_cgi
self.cgi_info = (os.path.dirname(path_cgi),
os.path.basename(path_cgi))
self.request = request
self.server = request.server
self.command = request.command
self.headers = request.headers
self.client_address = ('unknown', 0)
self.rfile = request.rfile
self.wfile = tempfile.TemporaryFile()
def translate_path(self, path): return path
def send_response(self, code, message):
self.wfile.write('X-Response-Code: %s\r\n' % code)
self.wfile.write('X-Response-Message: %s\r\n' % message)
def send_error(self, code, message):
return self.send_response(code, message)
def Run(self):
self.run_cgi()
self.wfile.seek(0)
return self.wfile
class UiRequestHandler(SimpleXMLRPCRequestHandler):
# Make all paths/endpoints legal, we interpret them below.
rpc_paths = ( )
E403 = { 'code': '403', 'msg': 'Missing', 'mimetype': 'text/html',
'title': '403 Not found',
'body': '
\n', code=500, msg='Asplode')
self.wfile.flush()
os._exit(2)
elif path.startswith('/_pagekite/add_kite/'):
data.update(self.add_kite(path, qs))
elif path.endswith('/pagekite.rc'):
data.update({'mimetype': 'application/octet-stream',
'body': '\n'.join(self.server.pkite.GenerateConfig())})
elif path.endswith('/pagekite.rc.txt'):
data.update({'mimetype': 'text/plain',
'body': '\n'.join(self.server.pkite.GenerateConfig())})
elif path.endswith('/pagekite.cfg'):
data.update({'mimetype': 'application/octet-stream',
'body': '\r\n'.join(self.server.pkite.GenerateConfig())})
else:
data.update(self.E403)
else:
if self.sendStaticPath(path, data['mimetype'], shtml_vars=data):
return
if path == '/robots.txt':
data.update(self.ROBOTSTXT)
else:
data.update(self.E404)
if data['mimetype'] in ('application/octet-stream', 'text/plain'):
response = self.TEMPLATE_RAW % data
elif path.endswith('.jsonp'):
response = self.TEMPLATE_JSONP % (data, )
else:
response = self.TEMPLATE_HTML % data
self.sendResponse(response, msg=data['msg'],
code=data['code'],
mimetype=data['mimetype'],
chunked=False)
self.sendEof()
class RemoteControlInterface(object):
ACL_OPEN = ''
ACL_READ = 'r'
ACL_WRITE = 'w'
def __init__(self, httpd, pkite, conns):
self.httpd = httpd
self.pkite = pkite
self.conns = conns
self.modified = False
self.lock = threading.Lock()
self.request = None
# For now, nobody gets ACL_WRITE
self.auth_tokens = {httpd.secret: self.ACL_READ}
# Channels are in-memory logs which can be tailed over XML-RPC.
# Javascript apps can create these for implementing chat etc.
self.channels = {'LOG': {'access': self.ACL_READ,
'tokens': self.auth_tokens,
'data': logging.LOG}}
def _BEGIN(self, request_object):
self.lock.acquire()
self.request = request_object
return request_object
def _END(self, rv=None):
if self.request:
self.request = None
self.lock.release()
return rv
def connections(self, auth_token):
if (not self.request.host_config.get('console', False) or
self.ACL_READ not in self.auth_tokens.get(auth_token, self.ACL_OPEN)):
raise AuthError('Unauthorized')
return [{'sid': c.sid,
'dead': c.dead,
'html': c.__html__()} for c in self.conns.conns]
def add_kite(self, auth_token, kite_domain, kite_proto):
if (not self.request.host_config.get('console', False) or
self.ACL_WRITE not in self.auth_tokens.get(auth_token, self.ACL_OPEN)):
raise AuthError('Unauthorized')
pass
def get_kites(self, auth_token):
if (not self.request.host_config.get('console', False) or
self.ACL_READ not in self.auth_tokens.get(auth_token, self.ACL_OPEN)):
raise AuthError('Unauthorized')
kites = []
for bid in self.pkite.backends:
proto, domain = bid.split(':')
fe_proto = proto.split('-')
kite_info = {
'id': bid,
'domain': domain,
'fe_proto': fe_proto[0],
'fe_port': (len(fe_proto) > 1) and fe_proto[1] or '',
'fe_secret': self.pkite.backends[bid][BE_SECRET],
'be_proto': self.pkite.backends[bid][BE_PROTO],
'backend': self.pkite.backends[bid][BE_BACKEND],
'fe_list': [{'name': fe.server_name,
'tls': fe.using_tls,
'sid': fe.sid} for fe in self.conns.Tunnel(proto, domain)]
}
kites.append(kite_info)
return kites
def add_kite(self, auth_token,
proto,
fe_port, fe_domain,
be_port, be_domain,
shared_secret):
if (not self.request.host_config.get('console', False) or
self.ACL_WRITE not in self.auth_tokens.get(auth_token, self.ACL_OPEN)):
raise AuthError('Unauthorized')
# FIXME
def remove_kite(self, auth_token, kite_id):
if (not self.request.host_config.get('console', False) or
self.ACL_WRITE not in self.auth_tokens.get(auth_token, self.ACL_OPEN)):
raise AuthError('Unauthorized')
if kite_id in self.pkite.backends:
del self.pkite.backends[kite_id]
logging.Log([('reconfigured', '1'), ('removed', kite_id)])
self.modified = True
return self.get_kites(auth_token)
def mk_channel(self, auth_token, channel):
if not self.request.host_config.get('channels', False):
raise AuthError('Unauthorized')
chid = '%s/%s' % (self.request.http_host, channel)
if chid in self.channels:
raise Error('Exists')
else:
self.channels[chid] = {'access': self.ACL_WRITE,
'tokens': {auth_token: self.ACL_WRITE},
'data': []}
return self.append_channel(auth_token, channel, {'created': channel})
def get_channel(self, auth_token, channel):
if not self.request.host_config.get('channels', False):
raise AuthError('Unauthorized')
chan = self.channels.get('%s/%s' % (self.request.http_host, channel),
self.channels.get(channel, {}))
req = chan.get('access', self.ACL_WRITE)
if req not in chan.get('tokens', self.auth_tokens).get(auth_token,
self.ACL_OPEN):
raise AuthError('Unauthorized')
return chan.get('data', [])
def append_channel(self, auth_token, channel, values):
data = self.get_channel(auth_token, channel)
global LOG_LINE
values.update({'ts': '%x' % time.time(), 'll': '%x' % LOG_LINE})
LOG_LINE += 1
data.append(values)
return values
def get_channel_after(self, auth_token, channel, last_seen, timeout):
data = self.get_channel(auth_token, channel)
last_seen = int(last_seen, 16)
# line at the remote end, then we've restarted and should send everything.
if (last_seen == 0) or (LOG_LINE < last_seen): return data
# FIXME: LOG_LINE global for all channels? Is that suck?
# We are about to get sleepy, so release our environment lock.
self._END()
# If our internal LOG_LINE counter is less than the count of the last seen
# Else, wait at least one second, AND wait for a new line to be added to
# the log (or the timeout to expire).
time.sleep(1)
last_ll = data[-1]['ll']
while (timeout > 0) and (data[-1]['ll'] == last_ll):
time.sleep(1)
timeout -= 1
# Return everything the client hasn't already seen.
return [ll for ll in data if int(ll['ll'], 16) > last_seen]
class UiHttpServer(SocketServer.ThreadingMixIn, SimpleXMLRPCServer):
def __init__(self, sspec, pkite, conns,
handler=UiRequestHandler,
ssl_pem_filename=None):
SimpleXMLRPCServer.__init__(self, sspec, handler)
self.pkite = pkite
self.conns = conns
self.secret = pkite.ConfigSecret()
self.server_name = sspec[0]
self.server_port = sspec[1]
if ssl_pem_filename:
ctx = socks.SSL.Context(socks.SSL.TLSv1_METHOD)
ctx.set_cipher_list('HIGH:-aNULL:-eNULL:-PSK:RC4-SHA:RC4-MD5')
ctx.use_privatekey_file (ssl_pem_filename)
ctx.use_certificate_chain_file(ssl_pem_filename)
self.socket = socks.SSL_Connect(ctx, socket.socket(self.address_family,
self.socket_type),
server_side=True)
self.server_bind()
self.server_activate()
self.enable_ssl = True
else:
self.enable_ssl = False
try:
from pagekite import yamond
gYamon = common.gYamon = yamond.YamonD(sspec)
gYamon.vset('started', int(time.time()))
gYamon.vset('version', APPVER)
gYamon.vset('httpd_ssl_enabled', self.enable_ssl)
gYamon.vset('errors', 0)
gYamon.lcreate("tunnel_rtt", 100)
gYamon.lcreate("tunnel_wrtt", 100)
gYamon.lists['buffered_bytes'] = [1, 0, common.buffered_bytes]
gYamon.views['selectables'] = (selectables.SELECTABLES, {
'idle': [0, 0, self.conns.idle],
'conns': [0, 0, self.conns.conns]
})
except:
pass
self.RCI = RemoteControlInterface(self, pkite, conns)
self.register_introspection_functions()
self.register_instance(self.RCI)
def finish_request(self, request, client_address):
try:
SimpleXMLRPCServer.finish_request(self, request, client_address)
except (socket.error, socks.SSL.ZeroReturnError, socks.SSL.Error):
pass
def shutdown_request(self, *args):
try:
return SimpleXMLRPCServer.shutdown_request(self, *args)
except TypeError:
return SimpleXMLRPCServer.close_request(self, *args)
pagekite-0.5.9.3/pagekite/logparse.py 0000755 0000000 0000000 00000013151 13232067545 017407 0 ustar root root 0000000 0000000 """
A basic tool for processing and parsing the Pagekite logs. This class
doesn't actually do anything much, it's meant for subclassing.
"""
##############################################################################
LICENSE = """\
This file is part of pagekite.py.
Copyright 2010-2017, the Beanstalks Project ehf. and Bjarni Runar Einarsson
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU Affero General Public License as published by the Free
Software Foundation, either version 3 of the License, or (at your option) any
later version.
This program is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see:
"""
##############################################################################
import os
import sys
import time
class PageKiteLogParser(object):
def __init__(self):
pass
def ParseLine(self, line, data=None):
try:
if data is None: data = {}
for word in line.split('; '):
key, val = word.split('=', 1);
data[key] = val
return data
except Exception:
return {'raw': '%s' % line}
def ProcessData(self, data):
print '%s' % data
def ProcessLine(self, line, data=None):
self.ProcessData(self.ParseLine(line, data))
def Follow(self, fd, filename):
# Record last position...
pos = fd.tell()
try:
if os.stat(filename).st_size < pos:
# Re-open log-file if it's been rotated/trucated
new_fd = open(filename, 'r')
fd.close()
return new_fd
except (OSError, IOError), e:
# Failed to stat or open new file, just try again later.
pass
# Sleep a bit and then try to read some more
time.sleep(1)
fd.seek(pos)
return fd
def ReadLog(self, filename=None, after=None, follow=False):
if filename is not None:
fd = open(filename, 'r')
else:
fd = sys.stdin
first = True
while first or follow:
for line in fd:
if line.endswith('\n'):
data = self.ParseLine(line.strip())
if after is None or ('ts' in data and int(data['ts'], 16) > after):
self.ProcessData(data)
else:
fd.seek(fd.tell() - len(line))
break
if follow: fd = self.Follow(fd, filename)
first = False
def ReadSyslog(self, filename, pname='pagekite.py', after=None, follow=False):
fd = open(filename, 'r')
tag = ' %s[' % pname
first = True
while first or follow:
for line in fd:
if line.endswith('\n'):
try:
parts = line.split(':', 3)
if parts[2].find(tag) > -1:
data = self.ParseLine(parts[3].strip())
if after is None or int(data['ts'], 16) > after:
self.ProcessData(data)
except ValueError, e:
pass
else:
fd.seek(fd.tell() - len(line))
break
if follow: fd = self.Follow(fd, filename)
first = False
class PageKiteLogTracker(PageKiteLogParser):
def __init__(self):
PageKiteLogParser.__init__(self)
self.streams = {}
def ProcessRestart(self, data):
# Program just restarted, discard streams state.
self.streams = {}
def ProcessBandwidthRead(self, stream, data):
stream['read'] += int(data['read'])
def ProcessBandwidthWrote(self, stream, data):
stream['wrote'] += int(data['wrote'])
def ProcessError(self, stream, data):
stream['err'] = data['err']
def ProcessEof(self, stream, data):
del self.streams[stream['id']]
def ProcessNewStream(self, stream, data):
self.streams[stream['id']] = stream
stream['read'] = 0
stream['wrote'] = 0
def ProcessData(self, data):
if 'id' in data:
# This is info about a specific stream...
sid = data['id']
if 'proto' in data and 'domain' in data and sid not in self.streams:
self.ProcessNewStream(data, data)
if sid in self.streams:
stream = self.streams[sid]
if 'err' in data: self.ProcessError(stream, data)
if 'read' in data: self.ProcessBandwidthRead(stream, data)
if 'wrote' in data: self.ProcessBandwidthWrote(stream, data)
if 'eof' in data: self.ProcessEof(stream, data)
elif 'started' in data and 'version' in data:
self.ProcessRestart(data)
class DebugPKLT(PageKiteLogTracker):
def ProcessRestart(self, data):
PageKiteLogTracker.ProcessRestart(self, data)
print 'RESTARTED %s' % data
def ProcessNewStream(self, stream, data):
PageKiteLogTracker.ProcessNewStream(self, stream, data)
print '[%s] NEW %s' % (stream['id'], data)
def ProcessBandwidthRead(self, stream, data):
PageKiteLogTracker.ProcessBandwidthRead(self, stream, data)
print '[%s] BWR %s' % (stream['id'], data)
def ProcessBandwidthWrote(self, stream, data):
PageKiteLogTracker.ProcessBandwidthWrote(self, stream, data)
print '[%s] BWW %s' % (stream['id'], data)
def ProcessError(self, stream, data):
PageKiteLogTracker.ProcessError(self, stream, data)
print '[%s] ERR %s' % (stream['id'], data)
def ProcessEof(self, stream, data):
PageKiteLogTracker.ProcessEof(self, stream, data)
print '[%s] EOF %s' % (stream['id'], data)
if __name__ == '__main__':
sys.stdout = os.fdopen(sys.stdout.fileno(), 'w', 0)
if len(sys.argv) > 2:
DebugPKLT().ReadSyslog(sys.argv[1], pname=sys.argv[2])
else:
DebugPKLT().ReadLog(sys.argv[1])
pagekite-0.5.9.3/PKG-INFO 0000644 0000000 0000000 00000001462 13232067643 014523 0 ustar root root 0000000 0000000 Metadata-Version: 1.0
Name: pagekite
Version: 0.5.9.3
Summary: PageKite makes localhost servers visible to the world.
Home-page: http://pagekite.org/
Author: Bjarni R. Einarsson
Author-email: bre@pagekite.net
License: AGPLv3+
Description: PageKite is a system for running publicly visible servers (generally
web servers) on machines without a direct connection to the Internet,
such as mobile devices or computers behind restrictive firewalls.
PageKite works around NAT, firewalls and IP-address limitations by
using a combination of tunnels and reverse proxies.
Natively supported protocols: HTTP, HTTPS
Any other TCP-based service, including SSH and VNC, may be exposed
as well to clients supporting HTTP Proxies.
Platform: UNKNOWN
pagekite-0.5.9.3/README.md 0000644 0000000 0000000 00000001036 13232067545 014703 0 ustar root root 0000000 0000000 # pagekite.py #
This is `pagekite.py`, a fast and reliable tool to make localhost servers
visible to the public Internet.
For stable releases and quick-start instructions, please see:
The full manual is in the `docs/` folder, or visible on-line here:
**Note:** This program is under active development and the contents of
this repository may at times be somewhat unstable. Stable source releases
are archived here:
pagekite-0.5.9.3/etc/ 0000755 0000000 0000000 00000000000 13232067643 014176 5 ustar root root 0000000 0000000 pagekite-0.5.9.3/etc/sysconfig/ 0000755 0000000 0000000 00000000000 13232067643 016202 5 ustar root root 0000000 0000000 pagekite-0.5.9.3/etc/sysconfig/pagekite.fedora 0000644 0000000 0000000 00000000151 13232067545 021153 0 ustar root root 0000000 0000000 OPTIONS="--optdir=/etc/pagekite.d"
PK_UID=daemon
PK_GID=daemon
PK_LOGFILE=/var/log/pagekite/pagekite.log
pagekite-0.5.9.3/etc/pagekite.d/ 0000755 0000000 0000000 00000000000 13232067643 016211 5 ustar root root 0000000 0000000 pagekite-0.5.9.3/etc/pagekite.d/accept.acl.sample 0000644 0000000 0000000 00000001477 13232067545 021423 0 ustar root root 0000000 0000000 # This is a sample ACL file for use with --accept_acl_file.
#
# This is a file for use on frontend relays to restrict access. Note
# that this effects both tunnels and client connections and is really
# only intended for blacklisting abusive clients on a temporary basis.
#
# To enable these rules, rename the file and add the following to one
# of the `/etc/pagekite.d/*.rc` files:
#
# accept_acl_file = /etc/pagekite.d/accept.acl
#
# For more routine access control, use `client_acl` or `tunnel_acl`
# in the main configuration file (or on the command line).
#
# This example rejects incoming connections from localhost and allows
# all others. Lines are processed in order, terminating on first match.
127.* deny Localhost is banned (IPv4)
::1 deny Localhost is banned (IPv6)
# The default is to allow connections
pagekite-0.5.9.3/etc/pagekite.d/80_httpd.rc.sample 0000644 0000000 0000000 00000001012 13232067545 021444 0 ustar root root 0000000 0000000 #################################[ This file is placed in the Public Domain. ]#
# Expose the local HTTPD
service_on = http:@kitename : localhost:80 : @kitesecret
#
# Uncomment the following to globally DISABLE the request firewall. Do this
# if you are sure you know what you are doing, for more details please see
#
#
#insecure
#
# To disable the firewall for one kite at a time, use lines like this::
#
#service_cfg = KITENAME.pagekite.me/80 : insecure : True
#
pagekite-0.5.9.3/etc/pagekite.d/80_sshd.rc.sample 0000644 0000000 0000000 00000000252 13232067545 021267 0 ustar root root 0000000 0000000 #################################[ This file is placed in the Public Domain. ]#
# Expose the local SSH daemon
service_on = raw/22:@kitename : localhost:22 : @kitesecret
pagekite-0.5.9.3/etc/pagekite.d/10_account.rc 0000644 0000000 0000000 00000000344 13232067545 020475 0 ustar root root 0000000 0000000 #################################[ This file is placed in the Public Domain. ]#
# Replace the following with your account details.
kitename = NAME.pagekite.me
kitesecret = YOURSECRET
# Delete this line!
abort_not_configured
pagekite-0.5.9.3/etc/pagekite.d/20_frontends.rc 0000644 0000000 0000000 00000000766 13232067545 021054 0 ustar root root 0000000 0000000 #################################[ This file is placed in the Public Domain. ]#
# Front-end selection
#
# Front-ends accept incoming requests on your behalf and forward them to
# your PageKite, which in turn forwards them to the actual server. You
# probably need at least one, the service defaults will choose one for you.
# Use the pagekite.net service defaults.
defaults
# If you want to use your own, use something like:
# frontend = hostname:port
# or:
# frontends = COUNT:dnsname:port
pagekite-0.5.9.3/etc/init.d/ 0000755 0000000 0000000 00000000000 13232067643 015363 5 ustar root root 0000000 0000000 pagekite-0.5.9.3/etc/init.d/pagekite.fedora 0000755 0000000 0000000 00000003722 13232067545 020346 0 ustar root root 0000000 0000000 #!/bin/bash
#
# pagekite Startup script for the PageKite background service
#
# chkconfig: - 85 15
# description: PageKite makes localhost servers publicly visible.
# processname: pagekite
# config: /etc/pagekite.d/50_daemonize.rc
# config: /etc/pagekite.d/10_account.rc
# pidfile: /var/run/pagekite.pid
# Source function library.
. /etc/rc.d/init.d/functions
if [ -f /etc/sysconfig/pagekite ]; then
. /etc/sysconfig/pagekite
fi
# Start PageKite in the C locale by default.
PK_LANG=${PK_LANG-"C"}
# Path to the server binary, and short-form for messages.
pk=/usr/bin/pagekite
prog=pagekite
pidfile=${PIDFILE-/var/run/pagekite.pid}
lockfile=${LOCKFILE-/var/lock/subsys/pagekite}
RETVAL=0
# Exit if package is unconfigured
grep -c ^abort_not_configured /etc/pagekite.d/10_account.rc \
2>/dev/null >/dev/null && exit 0
# Check for 0.3-style configuration
check03x () {
CONFFILE=/etc/pagekite/local.rc
# FIXME
true
}
start() {
echo -n $"Starting $prog: "
check03x || exit 1
touch $PK_LOGFILE
chown -R $PK_UID:$PK_GID $(dirname $PK_LOGFILE)
LANG=$PK_LANG daemon --pidfile=${pidfile} \
$pk --clean \
--runas=$PK_UID:$PK_GID \
--logfile=$PK_LOGFILE \
--pidfile=${pidfile} $OPTIONS \
--daemonize
RETVAL=$?
echo
[ $RETVAL = 0 ] && touch ${lockfile}
return $RETVAL
}
stop() {
echo -n $"Stopping $prog: "
killproc -p ${pidfile} $pk
RETVAL=$?
echo
[ $RETVAL = 0 ] && rm -f ${lockfile} ${pidfile}
}
# See how we were called.
case "$1" in
start)
start
;;
stop)
stop
;;
status)
status -p ${pidfile} $pk
RETVAL=$?
;;
restart|reload)
stop
start
;;
condrestart)
if [ -f ${pidfile} ] ; then
stop
start
fi
;;
*)
echo $"Usage: $prog {start|stop|restart|condrestart|reload|status}"
exit 1
esac
exit $RETVAL
pagekite-0.5.9.3/etc/init.d/pagekite.debian 0000755 0000000 0000000 00000011515 13232067545 020327 0 ustar root root 0000000 0000000 #! /bin/sh
### BEGIN INIT INFO
# Provides: pagekite
# Required-Start: $remote_fs $syslog $named
# Required-Stop: $remote_fs $syslog $named
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: PageKite system service
# Description: PageKite makes localhost servers publicly visible.
### END INIT INFO
# Authors: Bjarni R. Einarsson
# Hrafnkell Eiriksson
# Do NOT "set -e"
# PATH should only include /usr/* if it runs after the mountnfs.sh script
PATH=/sbin:/usr/sbin:/bin:/usr/bin
DESC="PageKite system service"
NAME=pagekite
RUNAS=daemon:daemon
DAEMON=/usr/bin/$NAME
WRAPPER=/usr/bin/daemon
PIDFILE=/var/run/$NAME.pid
LOGFILE=/var/log/$NAME/$NAME.log
WRAPPER_PIDFILE=$PIDFILE.wrapper
WRAPPER_ARGS="--noconfig --unsafe --respawn --delay=60 --name=$NAME"
DAEMON_ARGS="--clean \
--runas=$RUNAS \
--logfile=$LOGFILE \
--optdir=/etc/$NAME.d"
SCRIPTNAME=/etc/init.d/$NAME
# Exit if the package is not installed
[ -x "$DAEMON" ] || exit 0
# Exit if package is unconfigured
grep -c ^abort_not_configured /etc/pagekite.d/10_account.rc \
2>/dev/null >/dev/null && exit 0
# Read configuration variable file if it is present
[ -r /etc/default/$NAME ] && . /etc/default/$NAME
# Load the VERBOSE setting and other rcS variables
. /lib/init/vars.sh
# Define LSB log_* functions.
# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
. /lib/lsb/init-functions
#
# Function that starts the daemon/service
#
do_start()
{
# Return
# 0 if daemon has been started
# 1 if daemon was already running
# 2 if daemon could not be started
touch $LOGFILE
chown $RUNAS $(dirname $LOGFILE) $LOGFILE
if [ -x $WRAPPER ]; then
start-stop-daemon --quiet --pidfile $WRAPPER_PIDFILE --test --start \
--startas $WRAPPER > /dev/null \
|| return 1
start-stop-daemon \
--quiet --pidfile $WRAPPER_PIDFILE --start --startas $WRAPPER -- \
--pidfile $WRAPPER_PIDFILE $WRAPPER_ARGS -- $DAEMON \
--pidfile $PIDFILE $DAEMON_ARGS --noloop \
|| return 2
else
start-stop-daemon --quiet --pidfile $PIDFILE --test --start \
--startas $DAEMON > /dev/null \
|| return 1
start-stop-daemon \
--quiet --pidfile $PIDFILE --start --startas $DAEMON -- \
--pidfile $PIDFILE --daemonize $DAEMON_ARGS \
|| return 2
fi
# Add code here, if necessary, that waits for the process to be ready
# to handle requests from services started subsequently which depend
# on this one. As a last resort, sleep for some time.
}
#
# Function that stops the daemon/service
#
do_stop()
{
# Return
# 0 if daemon has been stopped
# 1 if daemon was already stopped
# 2 if daemon could not be stopped
# other if a failure occurred
if [ -e $WRAPPER_PIDFILE ]; then
start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 \
--pidfile $WRAPPER_PIDFILE
else
WRAPPERS=$(ps axw |grep $WRAPPER |grep $DAEMON \
|grep $LOGFILE |cut -b1-5)
if [ "$WRAPPERS" = "" ]; then
start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 \
--pidfile $PIDFILE
else
kill $WRAPPERS
start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 \
--pidfile $PIDFILE --oknodo
fi
fi
RETVAL="$?"
[ "$RETVAL" = 2 ] && return 2
# Many daemons don't delete their pidfiles when they exit.
rm -f $PIDFILE $WRAPPER_PIDFILE
return "$RETVAL"
}
case "$1" in
start)
[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
do_start
case "$?" in
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
esac
;;
stop)
[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
do_stop
case "$?" in
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
esac
;;
status)
status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
;;
#reload|force-reload)
#
# If do_reload() is not implemented then leave this commented out
# and leave 'force-reload' as an alias for 'restart'.
#
#log_daemon_msg "Reloading $DESC" "$NAME"
#do_reload
#log_end_msg $?
#;;
restart|force-reload)
#
# If the "reload" option is implemented then remove the
# 'force-reload' alias
#
log_daemon_msg "Restarting $DESC" "$NAME"
(do_stop
case "$?" in
0|1)
do_start
case "$?" in
0) log_end_msg 0 ;;
1) log_end_msg 1 ;; # Old process is still running
*) log_end_msg 1 ;; # Failed to start
esac
;;
*)
# Failed to stop
log_end_msg 1
;;
esac) &
;;
*)
echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
exit 3
;;
esac
:
pagekite-0.5.9.3/etc/logrotate.d/ 0000755 0000000 0000000 00000000000 13232067643 016420 5 ustar root root 0000000 0000000 pagekite-0.5.9.3/etc/logrotate.d/pagekite.fedora 0000644 0000000 0000000 00000000301 13232067545 021366 0 ustar root root 0000000 0000000 /var/log/pagekite/pagekite.log {
daily
missingok
rotate 7
postrotate
[ ! -f /var/run/pagekite.pid ] || kill -HUP `cat /var/run/pagekite.pid`
endscript
compress
notifempty
nocreate
}
pagekite-0.5.9.3/etc/logrotate.d/pagekite.debian 0000644 0000000 0000000 00000000323 13232067545 021354 0 ustar root root 0000000 0000000 /var/log/pagekite/pagekite.log {
daily
su daemon daemon
missingok
rotate 7
postrotate
[ ! -f /var/run/pagekite.pid ] || kill -HUP `cat /var/run/pagekite.pid`
endscript
compress
notifempty
nocreate
}
pagekite-0.5.9.3/pk 0000777 0000000 0000000 00000000000 13232067545 017641 2pagekite/__main__.py ustar root root 0000000 0000000 pagekite-0.5.9.3/setup.py 0000755 0000000 0000000 00000002254 13232067545 015144 0 ustar root root 0000000 0000000 #!/usr/bin/python
import time
from datetime import date
from setuptools import setup
from pagekite.common import APPVER
import os
try:
# This borks sdist.
os.remove('.SELF')
except:
pass
setup(
name="pagekite",
version=APPVER.replace('github', 'dev%d' % (120*int(time.time()/120))),
license="AGPLv3+",
author="Bjarni R. Einarsson",
author_email="bre@pagekite.net",
url="http://pagekite.org/",
description="""PageKite makes localhost servers visible to the world.""",
long_description="""\
PageKite is a system for running publicly visible servers (generally
web servers) on machines without a direct connection to the Internet,
such as mobile devices or computers behind restrictive firewalls.
PageKite works around NAT, firewalls and IP-address limitations by
using a combination of tunnels and reverse proxies.
Natively supported protocols: HTTP, HTTPS
Any other TCP-based service, including SSH and VNC, may be exposed
as well to clients supporting HTTP Proxies.
""",
packages=['pagekite', 'pagekite.ui', 'pagekite.proto'],
scripts=['scripts/pagekite', 'scripts/lapcat', 'scripts/vipagekite'],
install_requires=['SocksipyChain >= 2.0.15']
)
\n'
'