From f3a2af8f10175417bc0f679a5a0aa9bfca8ad1ce Mon Sep 17 00:00:00 2001 From: zzz Date: Wed, 1 Apr 2015 13:48:06 +0000 Subject: [PATCH 1/3] make job runner quantity configurable --- router/java/src/net/i2p/router/JobQueue.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/router/java/src/net/i2p/router/JobQueue.java b/router/java/src/net/i2p/router/JobQueue.java index b9be0d88b..5acde5196 100644 --- a/router/java/src/net/i2p/router/JobQueue.java +++ b/router/java/src/net/i2p/router/JobQueue.java @@ -74,7 +74,7 @@ public class JobQueue { /** default max # job queue runners operating */ private final static int DEFAULT_MAX_RUNNERS = 1; - /** router.config parameter to override the max runners @deprecated unimplemented */ + /** router.config parameter to override the max runners */ private final static String PROP_MAX_RUNNERS = "router.maxJobRunners"; /** how frequently should we check and update the max runners */ @@ -300,7 +300,7 @@ public class JobQueue { public void allowParallelOperation() { _allowParallelOperation = true; - runQueue(RUNNERS); + runQueue(_context.getProperty(PROP_MAX_RUNNERS, RUNNERS)); } /** @deprecated do you really want to do this? */ From 1ac8d991454ef97796ddf1090448096f8e09b0f9 Mon Sep 17 00:00:00 2001 From: zzz Date: Fri, 3 Apr 2015 12:19:41 +0000 Subject: [PATCH 2/3] i2ptunnel: Send HTTP server port 443 traffic to the server transparently, to support HTTPS over the same tunnel, when so configured. Jetty: Add extensive help to jetty-ssl.xml for setting up SSL on the same server. --- .../i2p/i2ptunnel/I2PTunnelHTTPServer.java | 63 +++-- installer/resources/eepsite/jetty-ssl.xml | 235 +++++++++++++++++- installer/resources/eepsite/jetty.xml | 13 - 3 files changed, 272 insertions(+), 39 deletions(-) diff --git a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPServer.java b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPServer.java index 3c8066c56..79b17c350 100644 --- a/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPServer.java +++ b/apps/i2ptunnel/java/src/net/i2p/i2ptunnel/I2PTunnelHTTPServer.java @@ -69,8 +69,8 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer { private long _startedOn = 0L; private ConnThrottler _postThrottler; - private final static byte[] ERR_UNAVAILABLE = - ("HTTP/1.1 503 Service Unavailable\r\n"+ + private final static String ERR_UNAVAILABLE = + "HTTP/1.1 503 Service Unavailable\r\n"+ "Content-Type: text/html; charset=iso-8859-1\r\n"+ "Cache-control: no-cache\r\n"+ "Connection: close\r\n"+ @@ -79,11 +79,10 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer { "503 Service Unavailable\n"+ "

503 Service Unavailable

\n" + "

This I2P website is unavailable. It may be down or undergoing maintenance.

\n" + - "") - .getBytes(); + ""; - private final static byte[] ERR_DENIED = - ("HTTP/1.1 403 Denied\r\n"+ + private final static String ERR_DENIED = + "HTTP/1.1 403 Denied\r\n"+ "Content-Type: text/html; charset=iso-8859-1\r\n"+ "Cache-control: no-cache\r\n"+ "Connection: close\r\n"+ @@ -92,11 +91,10 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer { "403 Denied\n"+ "

403 Denied

\n" + "

Denied due to excessive requests. Please try again later.

\n" + - "") - .getBytes(); + ""; - private final static byte[] ERR_INPROXY = - ("HTTP/1.1 403 Denied\r\n"+ + private final static String ERR_INPROXY = + "HTTP/1.1 403 Denied\r\n"+ "Content-Type: text/html; charset=iso-8859-1\r\n"+ "Cache-control: no-cache\r\n"+ "Connection: close\r\n"+ @@ -105,8 +103,19 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer { "403 Denied\n"+ "

403 Denied

\n" + "

Inproxy access denied. You must run I2P to access this site.

\n" + - "") - .getBytes(); + ""; + + private final static String ERR_SSL = + "HTTP/1.1 503 Service Unavailable\r\n"+ + "Content-Type: text/html; charset=iso-8859-1\r\n"+ + "Cache-control: no-cache\r\n"+ + "Connection: close\r\n"+ + "Proxy-Connection: close\r\n"+ + "\r\n"+ + "503 Service Unavailable\n"+ + "

503 Service Unavailable

\n" + + "

This I2P website is not configured for SSL.

\n" + + ""; public I2PTunnelHTTPServer(InetAddress host, int port, String privData, String spoofHost, Logging l, EventDispatcher notifyThis, I2PTunnel tunnel) { super(host, port, privData, l, notifyThis, tunnel); @@ -203,7 +212,27 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer { //local is fast, so synchronously. Does not need that many //threads. try { + if (socket.getLocalPort() == 443) { + if (getTunnel().getClientOptions().getProperty("targetForPort.443") == null) { + try { + socket.getOutputStream().write(ERR_SSL.getBytes("UTF-8")); + } catch (IOException ioe) { + } finally { + try { + socket.close(); + } catch (IOException ioe) {} + } + return; + } + Socket s = getSocket(socket.getPeerDestination().calculateHash(), 443); + Runnable t = new I2PTunnelRunner(s, socket, slock, null, null, + null, (I2PTunnelRunner.FailCallback) null); + _clientExecutor.execute(t); + return; + } + long afterAccept = getTunnel().getContext().clock().now(); + // The headers _should_ be in the first packet, but // may not be, depending on the client-side options socket.setReadTimeout(HEADER_TIMEOUT); @@ -237,7 +266,7 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer { try { // Send a 403, so the user doesn't get an HTTP Proxy error message // and blame his router or the network. - socket.getOutputStream().write(ERR_INPROXY); + socket.getOutputStream().write(ERR_INPROXY.getBytes("UTF-8")); } catch (IOException ioe) {} try { socket.close(); @@ -254,7 +283,7 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer { try { // Send a 403, so the user doesn't get an HTTP Proxy error message // and blame his router or the network. - socket.getOutputStream().write(ERR_DENIED); + socket.getOutputStream().write(ERR_DENIED.getBytes("UTF-8")); } catch (IOException ioe) {} try { socket.close(); @@ -339,7 +368,7 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer { try { // Send a 503, so the user doesn't get an HTTP Proxy error message // and blame his router or the network. - socket.getOutputStream().write(ERR_UNAVAILABLE); + socket.getOutputStream().write(ERR_UNAVAILABLE.getBytes("UTF-8")); } catch (IOException ioe) {} try { socket.close(); @@ -360,7 +389,7 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer { try { // Send a 503, so the user doesn't get an HTTP Proxy error message // and blame his router or the network. - socket.getOutputStream().write(ERR_UNAVAILABLE); + socket.getOutputStream().write(ERR_UNAVAILABLE.getBytes("UTF-8")); } catch (IOException ioe) {} try { socket.close(); @@ -451,7 +480,7 @@ public class I2PTunnelHTTPServer extends I2PTunnelServer { try { if (browserout == null) browserout = _browser.getOutputStream(); - browserout.write(ERR_UNAVAILABLE); + browserout.write(ERR_UNAVAILABLE.getBytes("UTF-8")); } catch (IOException ioe) {} } catch (IOException ioe) { if (_log.shouldLog(Log.WARN)) diff --git a/installer/resources/eepsite/jetty-ssl.xml b/installer/resources/eepsite/jetty-ssl.xml index c6d91cc83..56253c6b9 100644 --- a/installer/resources/eepsite/jetty-ssl.xml +++ b/installer/resources/eepsite/jetty-ssl.xml @@ -1,35 +1,252 @@ + + + + + + + + + - - + - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +<-- clientApp.3.args="eepsite/jetty.xml" --> + +<-- clientApp.3.args="/path to/.i2p/eepsite/jetty.xml" "/path/to/.i2p/eepsite/jetty-ssl.xml" --> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - ./eepsite/etc/keystore - OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4 - OBF:1u2u1wml1z7s1z7a1wnl1u2g - ./eepsite/etc/keystore - OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4 + ./eepsite/etc/keystore.ks + changeit + myKeyPassword + ./eepsite/etc/keystore.ks + changeit - 8443 + 7668 600000 false 2 100 + + + SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA + SSL_DH_anon_EXPORT_WITH_RC4_40_MD5 + SSL_DH_anon_WITH_3DES_EDE_CBC_SHA + SSL_DH_anon_WITH_DES_CBC_SHA + SSL_DH_anon_WITH_RC4_128_MD5 + SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA + SSL_DHE_DSS_WITH_DES_CBC_SHA + SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA + SSL_DHE_RSA_WITH_DES_CBC_SHA + SSL_RSA_EXPORT_WITH_DES40_CBC_SHA + SSL_RSA_EXPORT_WITH_RC4_40_MD5 + SSL_RSA_WITH_DES_CBC_SHA + SSL_RSA_WITH_NULL_MD5 + SSL_RSA_WITH_NULL_SHA + TLS_DH_anon_WITH_AES_128_CBC_SHA + TLS_DH_anon_WITH_AES_128_CBC_SHA256 + TLS_DH_anon_WITH_AES_128_GCM_SHA256 + TLS_DH_anon_WITH_AES_256_CBC_SHA + TLS_DH_anon_WITH_AES_256_CBC_SHA256 + TLS_DH_anon_WITH_AES_256_GCM_SHA384 + TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA + TLS_ECDH_anon_WITH_AES_128_CBC_SHA + TLS_ECDH_anon_WITH_AES_256_CBC_SHA + TLS_ECDH_anon_WITH_NULL_SHA + TLS_ECDH_anon_WITH_RC4_128_SHA + TLS_ECDH_ECDSA_WITH_NULL_SHA + TLS_ECDHE_ECDSA_WITH_NULL_SHA + TLS_ECDHE_RSA_WITH_NULL_SHA + TLS_ECDH_RSA_WITH_NULL_SHA + TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5 + TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA + TLS_KRB5_EXPORT_WITH_RC4_40_MD5 + TLS_KRB5_EXPORT_WITH_RC4_40_SHA + TLS_KRB5_WITH_3DES_EDE_CBC_MD5 + TLS_KRB5_WITH_3DES_EDE_CBC_SHA + TLS_KRB5_WITH_DES_CBC_MD5 + TLS_KRB5_WITH_DES_CBC_SHA + TLS_KRB5_WITH_RC4_128_MD5 + TLS_KRB5_WITH_RC4_128_SHA + TLS_RSA_WITH_NULL_SHA256 + SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA + SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA + SSL_RSA_WITH_3DES_EDE_CBC_SHA + SSL_RSA_WITH_RC4_128_MD5 + SSL_RSA_WITH_RC4_128_SHA + TLS_ECDH_ECDSA_WITH_RC4_128_SHA + TLS_ECDH_RSA_WITH_RC4_128_SHA + TLS_ECDHE_ECDSA_WITH_RC4_128_SHA + TLS_ECDHE_RSA_WITH_RC4_128_SHA + TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA + TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA + TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + + diff --git a/installer/resources/eepsite/jetty.xml b/installer/resources/eepsite/jetty.xml index b52445953..f828a1d9f 100644 --- a/installer/resources/eepsite/jetty.xml +++ b/installer/resources/eepsite/jetty.xml @@ -168,19 +168,6 @@ - - - - - - - - - - - From 75a8d8f6d350c32dc7bb5f9e8cc0d432c660ab28 Mon Sep 17 00:00:00 2001 From: zzz Date: Fri, 3 Apr 2015 13:33:59 +0000 Subject: [PATCH 3/3] more ssl config tweaks --- installer/resources/eepsite/jetty-ssl.xml | 9 ++++++--- installer/resources/eepsite/jetty.xml | 2 -- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/installer/resources/eepsite/jetty-ssl.xml b/installer/resources/eepsite/jetty-ssl.xml index 56253c6b9..d27effe37 100644 --- a/installer/resources/eepsite/jetty-ssl.xml +++ b/installer/resources/eepsite/jetty-ssl.xml @@ -185,11 +185,14 @@ - 7668 + 127.0.0.1 + 7668 600000 false - 2 - 100 + 1 + false + 5000 + 5000 SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA diff --git a/installer/resources/eepsite/jetty.xml b/installer/resources/eepsite/jetty.xml index f828a1d9f..432bb347e 100644 --- a/installer/resources/eepsite/jetty.xml +++ b/installer/resources/eepsite/jetty.xml @@ -135,7 +135,6 @@ 600000 1 false - 8443 5000 5000 false @@ -155,7 +154,6 @@ 600000 1 false - 8443