Control Port Filter Proxy Python (cpfpy) / anon-ws-disable-stacked-tor

HulaHoop · November 13, 2014, 5:34pm

Troubadour can you please write an Apparmor profile for cpfp.py by time it becomes default in Whonix 10?

troubadour · November 13, 2014, 11:23pm

It’s in the pipeline, but there is some updates to the AppArmor wiki first. Have you installed the profiles from the testers repository?

HulaHoop · November 14, 2014, 12:59pm

@troubadour Yes I’m running the profiles from the whonix-developers repo and they are working great. Thanks.

Patrick · November 14, 2014, 9:42pm

Looking into linters today… Especially those with a pretty free web interface and such.

What’s your opinion on

Useful or not so much? I think we should not become slaves of security irrelevant advice by (eventually broken, biased) static code analysis utilities. Maybe it’s good enough consider its opinions when getting close to releases.

[hr]

Know pylint?

sudo apt-get install pylint

pylint usr/lib/cpfp.py

troubadour · November 16, 2014, 9:03pm

[quote=“Patrick, post:104, topic:533”]Looking into linters today… Especially those with a pretty free web interface and such.

What’s your opinion on

Useful or not so much? I think we should not become slaves of security irrelevant advice by (eventually broken, biased) static code analysis utilities. Maybe it’s good enough consider its opinions when getting close to releases.[/quote]
Yes, we’ll try to comply, eventually. For the overall bad score, see below.

Know pylint?
sudo apt-get install pylint
pylint usr/lib/cpfp.py

I did not know pylint. The negative note was mostly explained by the indentation. At the time, I had read some recommendations to use two spaces indentation, and my tools were probably not properly set. Now I’m using four spaces, no tab, and Kate and Eric (the Python IDE I use, not the best, but it’s available from Debian) are speaking the same language. Good for them.

Patrick · January 10, 2015, 5:33pm

Can you please rename:
usr/bin/controlportfilt
man/controlportfilt.8.ronn

“controlportfilt” to “cpfpy” or so?

I guess we don’t need those files anyhow. Once systemd unit file has been created, /usr/lib/cpfp.py can be started by systemd.

troubadour · January 10, 2015, 7:36pm

Done. renaming files. · troubadoour/control-port-filter-python@bc4373a · GitHub

Patrick · January 10, 2015, 8:08pm

Merged.

[hr]

Small git hint: This is how I easily audit the diff when file names were changed.

(Otherwise it’s telling the diff viewer to diff against /dev/null twice, which isn’t helpful.)

Patrick · February 6, 2015, 11:15pm

Added to Whonix source code folder:
https://github.com/Whonix/Whonix/commit/2d55352787ccea7e9c7ea7458b34509833b661f2

Patrick · February 7, 2015, 12:07am

Wanted to polish this for release of Whonix 10. Added quite some commits.

Now I need your help. When running “usr/lib/control-port-filter-python/cpfp.py”, “sudo usr/lib/control-port-filter-python/cpfp.py” or “sudo -u debian-tor usr/lib/control-port-filter-python/cpfp.py” it doesn’t show any output and exits 0. It doesn’t print anything below line “server = SocketServer.TCPServer((IP, PORT), TCPHandler)”.

The error is probably quite a simple one. Missing dependencies. They are not yet added to the package. What debian packages need to be added to be able to run cpfp.py? We must have discussed this before, but I am not finding it anymore.

troubadour · February 9, 2015, 5:10pm

No missing dependencies. The only difference from the original script is the log file. So, let’s start from that. When changing back to “controlportfilt.log”, it works. The only difference then is the log file ownership. Back to “control-port-filter-python.log”, chown’d it to debian-tor and it works, on its own as well as when restarting the service .

I have no logical explanation, because it should not matter, when the daemon is run on its own.

Patrick · February 10, 2015, 12:26am

My mistake. It’s working fine.

Manually starting it also works.

Patrick · February 10, 2015, 1:04am

install control-port-filter-python https://github.com/Whonix/control-port-filter-python replacement that has been written by @troubadoour troubadoour (troubadour) · GitHub rather than control-port-filter https://github.com/Whonix/control-port-filter (bash), done:
install control-port-filter-python https://github.com/Whonix/control-… · Whonix/anon-meta-packages@0a5fb6d · GitHub

So next developers-only and/or testers-only version and Whonix 10 comes with cpfpy.

Patrick · February 10, 2015, 1:11am

minor:

Patrick · February 10, 2015, 1:17am

To hopefully allow smooth upgrades:

Patrick · February 10, 2015, 1:19am

debian/control: added “Pre-Depends: tor” so user and group “debian-tor” exist:
https://github.com/Whonix/control-port-filter-python/commit/8b47bc0f323ca836797223d0480b65fe2a5182ce

Patrick · February 10, 2015, 1:24am

debian/control: added “Uploaders: Patrick Schleizer adrelanos@riseup.net” to fix lintian warnings “W: control-port-filter-python source: changelog-should-mention-nmu” and “W: control-port-filter-python source: source-nmu-has-incorrect-version-number 3:0.3-1”:
https://github.com/Whonix/control-port-filter-python/commit/164812a565dfe3baa18ccf3f4c49895b368d39f3

Patrick · February 10, 2015, 1:40am

update for control-port-filter-python check:
https://github.com/Whonix/whonixcheck/commit/cb0d1e8b4af392c8d1dedb51263f2944b8d24467

Patrick · February 10, 2015, 1:50am

init script: fixed “sudo service control-port-filter-python status”:
https://github.com/Whonix/control-port-filter-python/commit/22270c574210c67329b60ea3381e9a364e379212

Patrick · February 16, 2015, 10:35am

bumped debian/compat version from 8 to 9:
https://github.com/Whonix/control-port-filter-python/commit/ceda2b02da46fd899a3200f057593c356f701339