33de701263
* refactor(atomicx): move outside the engine package
After merging probe-engine into probe-cli, my impression is that we have
too much unnecessary nesting of packages in this repository.
The idea of this commit and of a bunch of following commits will instead
be to reduce the nesting and simplify the structure.
While there, improve the documentation.
* fix: always use the atomicx package
For consistency, never use sync/atomic and always use ./internal/atomicx
so we can just grep and make sure we're not risking to crash if we make
a subtle mistake on a 32 bit platform.
While there, mention in the contributing guidelines that we want to
always prefer the ./internal/atomicx package over sync/atomic.
* fix(atomicx): remove unnecessary constructor
We don't need a constructor here. The default constructed `&Int64{}`
instance is already usable and the constructor does not add anything to
what we are doing, rather it just creates extra confusion.
* cleanup(atomicx): we are not using Float64
Because atomicx.Float64 is unused, we can safely zap it.
* cleanup(atomicx): simplify impl and improve tests
We can simplify the implementation by using defer and by letting
the Load() method call Add(0).
We can improve tests by making many goroutines updated the
atomic int64 value concurrently.
* refactor(fsx): can live in the ./internal pkg
Let us reduce the amount of nesting. While there, ensure that the
package only exports the bare minimum, and improve the documentation
of the tests, to ease reading the code.
* refactor: move runtimex to ./internal
* refactor: move shellx into the ./internal package
While there, remove unnecessary dependency between packages.
While there, specify in the contributing guidelines that
one should use x/sys/execabs instead of os/exec.
* refactor: move ooapi into the ./internal pkg
* refactor(humanize): move to ./internal and better docs
* refactor: move platform to ./internal
* refactor(randx): move to ./internal
* refactor(multierror): move into the ./internal pkg
* refactor(kvstore): all kvstores in ./internal
Rather than having part of the kvstore inside ./internal/engine/kvstore
and part in ./internal/engine/kvstore.go, let us put every piece of code
that is kvstore related into the ./internal/kvstore package.
* fix(kvstore): always return ErrNoSuchKey on Get() error
It should help to use the kvstore everywhere removing all the
copies that are lingering around the tree.
* sessionresolver: make KVStore mandatory
Simplifies implementation. While there, use the ./internal/kvstore
package rather than having our private implementation.
* fix(ooapi): use the ./internal/kvstore package
* fix(platform): better documentation
288 lines
7.9 KiB
Go
288 lines
7.9 KiB
Go
// Jafar is a censorship simulation tool used for testing OONI.
|
|
package main
|
|
|
|
import (
|
|
"encoding/pem"
|
|
"errors"
|
|
"flag"
|
|
"fmt"
|
|
"io/ioutil"
|
|
"net"
|
|
"net/http"
|
|
"os"
|
|
"os/signal"
|
|
"strings"
|
|
"syscall"
|
|
|
|
"golang.org/x/sys/execabs"
|
|
|
|
"github.com/apex/log"
|
|
"github.com/apex/log/handlers/cli"
|
|
"github.com/miekg/dns"
|
|
"github.com/ooni/probe-cli/v3/internal/cmd/jafar/badproxy"
|
|
"github.com/ooni/probe-cli/v3/internal/cmd/jafar/flagx"
|
|
"github.com/ooni/probe-cli/v3/internal/cmd/jafar/httpproxy"
|
|
"github.com/ooni/probe-cli/v3/internal/cmd/jafar/iptables"
|
|
"github.com/ooni/probe-cli/v3/internal/cmd/jafar/resolver"
|
|
"github.com/ooni/probe-cli/v3/internal/cmd/jafar/tlsproxy"
|
|
"github.com/ooni/probe-cli/v3/internal/cmd/jafar/uncensored"
|
|
"github.com/ooni/probe-cli/v3/internal/runtimex"
|
|
"github.com/ooni/probe-cli/v3/internal/shellx"
|
|
)
|
|
|
|
var (
|
|
badProxyAddress *string
|
|
badProxyAddressTLS *string
|
|
badProxyTLSOutputCA *string
|
|
|
|
dnsProxyAddress *string
|
|
dnsProxyBlock flagx.StringArray
|
|
dnsProxyHijack flagx.StringArray
|
|
dnsProxyIgnore flagx.StringArray
|
|
|
|
httpProxyAddress *string
|
|
httpProxyBlock flagx.StringArray
|
|
|
|
iptablesDropIP flagx.StringArray
|
|
iptablesDropKeywordHex flagx.StringArray
|
|
iptablesDropKeyword flagx.StringArray
|
|
iptablesHijackDNSTo *string
|
|
iptablesHijackHTTPSTo *string
|
|
iptablesHijackHTTPTo *string
|
|
iptablesResetIP flagx.StringArray
|
|
iptablesResetKeywordHex flagx.StringArray
|
|
iptablesResetKeyword flagx.StringArray
|
|
|
|
mainCh chan os.Signal
|
|
mainCommand *string
|
|
mainUser *string
|
|
|
|
tag *string
|
|
|
|
tlsProxyAddress *string
|
|
tlsProxyBlock flagx.StringArray
|
|
|
|
uncensoredResolverURL *string
|
|
)
|
|
|
|
func init() {
|
|
// badProxy
|
|
badProxyAddress = flag.String(
|
|
"bad-proxy-address", "127.0.0.1:7117",
|
|
"Address where to listen for TCP connections",
|
|
)
|
|
badProxyAddressTLS = flag.String(
|
|
"bad-proxy-address-tls", "127.0.0.1:4114",
|
|
"Address where to listen for TLS connections",
|
|
)
|
|
badProxyTLSOutputCA = flag.String(
|
|
"bad-proxy-tls-output-ca", "badproxy.pem",
|
|
"File where to write the CA used by the bad proxy",
|
|
)
|
|
|
|
// dnsProxy
|
|
dnsProxyAddress = flag.String(
|
|
"dns-proxy-address", "127.0.0.1:53",
|
|
"Address where the DNS proxy should listen",
|
|
)
|
|
flag.Var(
|
|
&dnsProxyBlock, "dns-proxy-block",
|
|
"Register keyword triggering NXDOMAIN censorship",
|
|
)
|
|
flag.Var(
|
|
&dnsProxyHijack, "dns-proxy-hijack",
|
|
"Register keyword triggering redirection to 127.0.0.1",
|
|
)
|
|
flag.Var(
|
|
&dnsProxyIgnore, "dns-proxy-ignore",
|
|
"Register keyword causing the proxy to ignore the query",
|
|
)
|
|
|
|
// httpProxy
|
|
httpProxyAddress = flag.String(
|
|
"http-proxy-address", "127.0.0.1:80",
|
|
"Address where the HTTP proxy should listen",
|
|
)
|
|
flag.Var(
|
|
&httpProxyBlock, "http-proxy-block",
|
|
"Register keyword triggering HTTP 451 censorship",
|
|
)
|
|
|
|
// iptables
|
|
flag.Var(
|
|
&iptablesDropIP, "iptables-drop-ip",
|
|
"Drop traffic to the specified IP address",
|
|
)
|
|
flag.Var(
|
|
&iptablesDropKeywordHex, "iptables-drop-keyword-hex",
|
|
"Drop traffic containing the specified keyword in hex",
|
|
)
|
|
flag.Var(
|
|
&iptablesDropKeyword, "iptables-drop-keyword",
|
|
"Drop traffic containing the specified keyword",
|
|
)
|
|
iptablesHijackDNSTo = flag.String(
|
|
"iptables-hijack-dns-to", "",
|
|
"Hijack all DNS UDP traffic to the specified endpoint",
|
|
)
|
|
iptablesHijackHTTPSTo = flag.String(
|
|
"iptables-hijack-https-to", "",
|
|
"Hijack all HTTPS traffic to the specified endpoint",
|
|
)
|
|
iptablesHijackHTTPTo = flag.String(
|
|
"iptables-hijack-http-to", "",
|
|
"Hijack all HTTP traffic to the specified endpoint",
|
|
)
|
|
flag.Var(
|
|
&iptablesResetIP, "iptables-reset-ip",
|
|
"Reset TCP/IP traffic to the specified IP address",
|
|
)
|
|
flag.Var(
|
|
&iptablesResetKeywordHex, "iptables-reset-keyword-hex",
|
|
"Reset TCP/IP traffic containing the specified keyword in hex",
|
|
)
|
|
flag.Var(
|
|
&iptablesResetKeyword, "iptables-reset-keyword",
|
|
"Reset TCP/IP traffic containing the specified keyword",
|
|
)
|
|
|
|
// main
|
|
mainCh = make(chan os.Signal, 1)
|
|
signal.Notify(
|
|
mainCh, syscall.SIGHUP, syscall.SIGINT, syscall.SIGTERM, syscall.SIGQUIT,
|
|
)
|
|
mainCommand = flag.String("main-command", "", "Optional command to execute")
|
|
mainUser = flag.String("main-user", "nobody", "Run command as user")
|
|
|
|
// tag
|
|
tag = flag.String("tag", "", "Add tag to a specific run")
|
|
|
|
// tlsProxy
|
|
tlsProxyAddress = flag.String(
|
|
"tls-proxy-address", "127.0.0.1:443",
|
|
"Address where the HTTP proxy should listen",
|
|
)
|
|
flag.Var(
|
|
&tlsProxyBlock, "tls-proxy-block",
|
|
"Register keyword triggering TLS censorship",
|
|
)
|
|
|
|
// uncensored
|
|
uncensoredResolverURL = flag.String(
|
|
"uncensored-resolver-url", "dot://1.1.1.1:853",
|
|
"URL of an hopefully uncensored resolver",
|
|
)
|
|
}
|
|
|
|
func badProxyStart() net.Listener {
|
|
proxy := badproxy.NewCensoringProxy()
|
|
listener, err := proxy.Start(*badProxyAddress)
|
|
runtimex.PanicOnError(err, "proxy.Start failed")
|
|
return listener
|
|
}
|
|
|
|
func badProxyStartTLS() net.Listener {
|
|
proxy := badproxy.NewCensoringProxy()
|
|
listener, cert, err := proxy.StartTLS(*badProxyAddressTLS)
|
|
runtimex.PanicOnError(err, "proxy.StartTLS failed")
|
|
err = ioutil.WriteFile(*badProxyTLSOutputCA, pem.EncodeToMemory(&pem.Block{
|
|
Type: "CERTIFICATE",
|
|
Bytes: cert.Raw,
|
|
}), 0644)
|
|
runtimex.PanicOnError(err, "ioutil.WriteFile failed")
|
|
return listener
|
|
}
|
|
|
|
func dnsProxyStart(uncensored *uncensored.Client) *dns.Server {
|
|
proxy := resolver.NewCensoringResolver(
|
|
dnsProxyBlock, dnsProxyHijack, dnsProxyIgnore, uncensored,
|
|
)
|
|
server, err := proxy.Start(*dnsProxyAddress)
|
|
runtimex.PanicOnError(err, "proxy.Start failed")
|
|
return server
|
|
}
|
|
|
|
func httpProxyStart(uncensored *uncensored.Client) *http.Server {
|
|
proxy := httpproxy.NewCensoringProxy(httpProxyBlock, uncensored)
|
|
server, _, err := proxy.Start(*httpProxyAddress)
|
|
runtimex.PanicOnError(err, "proxy.Start failed")
|
|
return server
|
|
}
|
|
|
|
func iptablesStart() *iptables.CensoringPolicy {
|
|
policy := iptables.NewCensoringPolicy()
|
|
// For robustness waive the policy so we start afresh
|
|
policy.Waive()
|
|
policy.DropIPs = iptablesDropIP
|
|
policy.DropKeywordsHex = iptablesDropKeywordHex
|
|
policy.DropKeywords = iptablesDropKeyword
|
|
policy.HijackDNSAddress = *iptablesHijackDNSTo
|
|
policy.HijackHTTPSAddress = *iptablesHijackHTTPSTo
|
|
policy.HijackHTTPAddress = *iptablesHijackHTTPTo
|
|
policy.ResetIPs = iptablesResetIP
|
|
policy.ResetKeywordsHex = iptablesResetKeywordHex
|
|
policy.ResetKeywords = iptablesResetKeyword
|
|
err := policy.Apply()
|
|
runtimex.PanicOnError(err, "policy.Apply failed")
|
|
return policy
|
|
}
|
|
|
|
func tlsProxyStart(uncensored *uncensored.Client) net.Listener {
|
|
proxy := tlsproxy.NewCensoringProxy(tlsProxyBlock, uncensored)
|
|
listener, err := proxy.Start(*tlsProxyAddress)
|
|
runtimex.PanicOnError(err, "proxy.Start failed")
|
|
return listener
|
|
}
|
|
|
|
func newUncensoredClient() *uncensored.Client {
|
|
clnt, err := uncensored.NewClient(*uncensoredResolverURL)
|
|
runtimex.PanicOnError(err, "uncensored.NewClient failed")
|
|
return clnt
|
|
}
|
|
|
|
func mustx(err error, message string, osExit func(int)) {
|
|
if err != nil {
|
|
var (
|
|
exitcode = 1
|
|
exiterr *execabs.ExitError
|
|
)
|
|
if errors.As(err, &exiterr) {
|
|
exitcode = exiterr.ExitCode()
|
|
}
|
|
log.Errorf("%s", message)
|
|
osExit(exitcode)
|
|
}
|
|
}
|
|
|
|
func main() {
|
|
flag.Parse()
|
|
// TODO(bassosimone): we may want a verbose flag
|
|
log.SetLevel(log.InfoLevel)
|
|
log.SetHandler(cli.Default)
|
|
log.Infof("jafar command line: [%s]", strings.Join(os.Args, ", "))
|
|
log.Infof("jafar tag: %s", *tag)
|
|
uncensoredClient := newUncensoredClient()
|
|
defer uncensoredClient.CloseIdleConnections()
|
|
badlistener := badProxyStart()
|
|
defer badlistener.Close()
|
|
badtlslistener := badProxyStartTLS()
|
|
defer badtlslistener.Close()
|
|
dnsproxy := dnsProxyStart(uncensoredClient)
|
|
defer dnsproxy.Shutdown()
|
|
httpproxy := httpProxyStart(uncensoredClient)
|
|
defer httpproxy.Close()
|
|
tlslistener := tlsProxyStart(uncensoredClient)
|
|
defer tlslistener.Close()
|
|
policy := iptablesStart()
|
|
var err error
|
|
if *mainCommand != "" {
|
|
err = shellx.RunCommandline(fmt.Sprintf(
|
|
"sudo -u '%s' -- %s", *mainUser, *mainCommand,
|
|
))
|
|
} else {
|
|
<-mainCh
|
|
}
|
|
policy.Waive()
|
|
mustx(err, "subcommand failed", os.Exit)
|
|
}
|