Merge branch 'obfsproxy' into develop

11 files changed, 297 insertions, 0 deletions

diff --git a/provider_base/services/obfsproxy.json b/provider_base/services/obfsproxy.json
new file mode 100644
index 00000000..979d0ef9
--- /dev/null
+++ b/provider_base/services/obfsproxy.json
@@ -0,0 +1,9 @@
+{
+  "obfsproxy": {
+    "scramblesuit": {
+      "password": "= base32_secret('scramblesuit_password_'+name)",
+      "port" : "= rand_range('scramblesuit_port_'+name, 18000..32000)"
+    },
+    "gateway_address": "= try{pick_node(:obfs_gateway,nodes_near_me['services' => 'openvpn']).pick_fields('openvpn.gateway_address')} || try{pick_node(:obfs_gateway,nodes_like_me['services' => 'openvpn']).pick_fields('openvpn.gateway_address')}"
+  }
+}
diff --git a/provider_base/services/openvpn.json b/provider_base/services/openvpn.json
index 090afcd6..1906244c 100644
--- a/provider_base/services/openvpn.json
+++ b/provider_base/services/openvpn.json
@@ -26,5 +26,12 @@
       "keepalive": "10 30",
       "tun-ipv6": true
     }
+  },
+  "obfsproxy": {
+    "scramblesuit": {
+      "password": "= base32_secret('scramblesuit_password_'+name)",
+      "port" : "= rand_range('scramblesuit_port_'+name, 18000..32000)"
+    },
+    "gateway_address": "= openvpn.gateway_address"
   }
 }
diff --git a/puppet/manifests/site.pp b/puppet/manifests/site.pp
index 9afa5dfd..57942d99 100644
--- a/puppet/manifests/site.pp
+++ b/puppet/manifests/site.pp
@@ -10,6 +10,7 @@ notice("Services for ${fqdn}: ${services_str}")
 
 if member($services, 'openvpn') {
   include site_openvpn
+  include site_obfsproxy
 }
 
 if member($services, 'couchdb') {
@@ -42,4 +43,8 @@ if member($services, 'static') {
   include site_static
 }
 
+if member($services, 'obfsproxy') {
+  include site_obfsproxy
+}
+
 include site_config::packages::uninstall
diff --git a/puppet/modules/obfsproxy/files/obfsproxy_init b/puppet/modules/obfsproxy/files/obfsproxy_init
new file mode 100755
index 00000000..01c8013a
--- /dev/null
+++ b/puppet/modules/obfsproxy/files/obfsproxy_init
@@ -0,0 +1,93 @@
+#!/bin/sh
+
+### BEGIN INIT INFO
+# Provides:          obfsproxy daemon
+# Required-Start:    $remote_fs $syslog
+# Required-Stop:     $remote_fs $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: obfsproxy daemon
+# Description:       obfsproxy daemon
+### END INIT INFO
+
+. /lib/lsb/init-functions
+
+DAEMON=/usr/bin/obfsproxy
+NAME=obfsproxy
+DESC="obfsproxy daemon"
+USER=obfsproxy
+DATDIR=/etc/obfsproxy
+PIDFILE=/var/run/obfsproxy.pid
+CONF=$DATDIR/obfsproxy.conf
+LOGFILE=/var/log/obfsproxy.log
+
+# If the daemon is not there, then exit.
+test -x $DAEMON || exit 0
+
+if [ -f $CONF ] ; then
+  . $CONF
+else
+  echo "Obfsproxy configuration file is missing, aborting..."
+  exit 2
+fi
+
+DAEMONARGS=" --log-min-severity=$LOG --log-file=$LOGFILE --data-dir=$DATDIR \
+            $TRANSPORT $PARAM --dest=$DEST_IP:$DEST_PORT server $BINDADDR:$PORT"
+
+start_obfsproxy() {
+  start-stop-daemon --start --quiet --oknodo -m --pidfile $PIDFILE \
+		-b -c $USER --startas $DAEMON --$DAEMONARGS
+}
+
+stop_obfsproxy() {
+  start-stop-daemon --stop --quiet --oknodo --pidfile $PIDFILE
+}
+
+status_obfsproxy() {
+  status_of_proc -p $PIDFILE $DAEMON $NAME
+}
+
+case $1 in
+ start)
+  if [ -e $PIDFILE ]; then
+   status_obfsproxy
+   if [ $? = "0" ]; then
+    exit
+   fi
+  fi
+  log_begin_msg "Starting $DESC"
+  start_obfsproxy
+  log_end_msg $?
+  ;;
+ stop)
+  if [ -e $PIDFILE ]; then
+   status_obfsproxy
+   if [ $? = "0" ]; then
+     log_begin_msg "Stopping $DESC"
+     stop_obfsproxy
+     rm -f $PIDFILE
+     log_end_msg $?
+   fi
+  else
+     status_obfsproxy
+  fi
+  ;;
+ restart)
+  $0 stop && sleep 2 && $0 start
+  ;;
+ status)
+  status_obfsproxy
+  ;;
+ reload)
+  if [ -e $PIDFILE ]; then
+   start-stop-daemon --stop --signal USR1 --quiet --pidfile $PIDFILE --name $NAME
+   log_success_msg "$DESC reloaded successfully"
+  else
+   log_failure_msg "$PIDFILE does not exist"
+  fi
+  ;;
+ *)
+  echo "Usage: $0 {start|stop|restart|reload|status}"
+  exit 2
+  ;;
+esac
diff --git a/puppet/modules/obfsproxy/files/obfsproxy_logrotate b/puppet/modules/obfsproxy/files/obfsproxy_logrotate
new file mode 100644
index 00000000..e5679d0c
--- /dev/null
+++ b/puppet/modules/obfsproxy/files/obfsproxy_logrotate
@@ -0,0 +1,14 @@
+/var/log/obfsproxy.log {
+  daily
+  missingok
+  rotate 3
+  compress
+  delaycompress
+  notifempty
+  create 600 obfsproxy obfsproxy
+  postrotate
+    if [ -f /var/run/obfsproxy.pid ]; then
+      /etc/init.d/obfsproxy restart > /dev/null
+    fi
+  endscript
+}
diff --git a/puppet/modules/obfsproxy/manifests/init.pp b/puppet/modules/obfsproxy/manifests/init.pp
new file mode 100644
index 00000000..61714fdf
--- /dev/null
+++ b/puppet/modules/obfsproxy/manifests/init.pp
@@ -0,0 +1,86 @@
+class obfsproxy (
+  $transport,
+  $bind_address,
+  $port,
+  $param,
+  $dest_ip,
+  $dest_port,
+  $log_level = 'info'
+){
+
+  $user = 'obfsproxy'
+  $conf = '/etc/obfsproxy/obfsproxy.conf'
+
+  user { $user:
+    ensure => present,
+    system => true,
+    gid    => $user,
+  }
+
+  group { $user:
+    ensure => present,
+    system => true,
+  }
+
+  file { '/etc/init.d/obfsproxy':
+    path      => '/etc/init.d/obfsproxy',
+    ensure    => present,
+    source    => 'puppet:///modules/obfsproxy/obfsproxy_init',
+    owner     => 'root',
+    group     => 'root',
+    mode      => '0750',
+    require   => File[$conf],
+  }
+
+  file { $conf :
+    path    => $conf,
+    ensure  => present,
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0600',
+    content => template('obfsproxy/etc_conf.erb'),
+  }
+
+  file { '/etc/obfsproxy':
+    ensure  => directory,
+    owner   => $user,
+    group   => $user,
+    mode    => '0700',
+    require => User[$user],
+  }
+
+  file { '/var/log/obfsproxy.log':
+    ensure  => present,
+    owner   => $user,
+    group   => $user,
+    mode    => '0640',
+    require => User[$user],
+  }
+
+  file { '/etc/logrotate.d/obfsproxy':
+    ensure  => present,
+    source  => 'puppet:///modules/obfsproxy/obfsproxy_logrotate',
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    require => File['/var/log/obfsproxy.log'],
+  }
+
+  package { 'obfsproxy':
+    ensure  => present,
+    require => Class['site_apt::preferences::obfsproxy'],
+  }
+
+  service { 'obfsproxy':
+    ensure    => running,
+    subscribe => File[$conf],
+    require   => [
+      Package['obfsproxy'],
+      File['/etc/init.d/obfsproxy'],
+      User[$user],
+      Group[$user]]
+  }
+
+
+}
+
diff --git a/puppet/modules/obfsproxy/templates/etc_conf.erb b/puppet/modules/obfsproxy/templates/etc_conf.erb
new file mode 100644
index 00000000..8959ef78
--- /dev/null
+++ b/puppet/modules/obfsproxy/templates/etc_conf.erb
@@ -0,0 +1,11 @@
+TRANSPORT=<%= @transport %>
+PORT=<%= @port %>
+DEST_IP=<%= @dest_ip %>
+DEST_PORT=<%= @dest_port %>
+<% if @transport == "scramblesuit" -%>
+PARAM=--password=<%= @param %>
+<% else -%>
+PARAM=<%= @param %>
+<% end -%>
+LOG=<%= @log_level %>
+BINDADDR=<%= @bind_address %>
diff --git a/puppet/modules/site_apt/manifests/preferences/obfsproxy.pp b/puppet/modules/site_apt/manifests/preferences/obfsproxy.pp
new file mode 100644
index 00000000..75b01956
--- /dev/null
+++ b/puppet/modules/site_apt/manifests/preferences/obfsproxy.pp
@@ -0,0 +1,9 @@
+class site_apt::preferences::obfsproxy {
+
+  apt::preferences_snippet { 'obfsproxy':
+    package  => 'obfsproxy',
+    release  => 'wheezy-backports',
+    priority => 999;
+  }
+
+}
diff --git a/puppet/modules/site_obfsproxy/README b/puppet/modules/site_obfsproxy/README
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/puppet/modules/site_obfsproxy/README
diff --git a/puppet/modules/site_obfsproxy/manifests/init.pp b/puppet/modules/site_obfsproxy/manifests/init.pp
new file mode 100644
index 00000000..40b7fba8
--- /dev/null
+++ b/puppet/modules/site_obfsproxy/manifests/init.pp
@@ -0,0 +1,39 @@
+class site_obfsproxy {
+  tag 'leap_service'
+  Class['site_config::default'] -> Class['site_obfsproxy']
+
+  $transport = 'scramblesuit'
+
+  $obfsproxy    = hiera('obfsproxy')
+  $scramblesuit = $obfsproxy['scramblesuit']
+  $scram_pass   = $scramblesuit['password']
+  $scram_port   = $scramblesuit['port']
+  $dest_ip      = $obfsproxy['gateway_address']
+  $dest_port    = '443'
+
+   if $::services =~ /\bopenvpn\b/ {
+     $openvpn      = hiera('openvpn')
+     $bind_address = $openvpn['gateway_address']
+   }
+   elsif $::services =~ /\bobfsproxy\b/ {
+     $bind_address = hiera('ip_address')
+   }
+
+  include site_apt::preferences::twisted
+  include site_apt::preferences::obfsproxy
+
+  class { 'obfsproxy':
+    transport    => $transport,
+    bind_address => $bind_address,
+    port         => $scram_port,
+    param        => $scram_pass,
+    dest_ip      => $dest_ip,
+    dest_port    => $dest_port,
+  }
+
+  include site_shorewall::obfsproxy
+
+}
+
+
+
diff --git a/puppet/modules/site_shorewall/manifests/obfsproxy.pp b/puppet/modules/site_shorewall/manifests/obfsproxy.pp
new file mode 100644
index 00000000..68fb9b9f
--- /dev/null
+++ b/puppet/modules/site_shorewall/manifests/obfsproxy.pp
@@ -0,0 +1,24 @@
+class site_shorewall::obfsproxy {
+
+  include site_shorewall::defaults
+
+  $obfsproxy    = hiera('obfsproxy')
+  $scramblesuit = $obfsproxy['scramblesuit']
+  $scram_port   = $scramblesuit['port']
+
+  # define macro for incoming services
+  file { '/etc/shorewall/macro.leap_obfsproxy':
+    content => "PARAM   -       -       tcp    $scram_port ",
+    notify  => Service['shorewall'],
+    require => Package['shorewall']
+  }
+
+  shorewall::rule {
+      'net2fw-obfs':
+        source      => 'net',
+        destination => '$FW',
+        action      => 'leap_obfsproxy(ACCEPT)',
+        order       => 200;
+  }
+
+}