archives/snowflake
2
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake.git synced 2025-10-13 20:11:19 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Use Manager.HTTPHandler for automatic TLS support in the server.

Browse source 
As with commit fcc274ac68 for the broker,
we need to start using the HTTP-01 challenge type in the Snowflake
websocket server transport plugin.
https://bugs.torproject.org/25346
This commit is contained in:
David Fifield 2018-03-05 15:25:48 -08:00
parent c62111c507
commit d0686b1c8d
2 changed files with 24 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

13
server/README.md
View file

@ -7,10 +7,10 @@ and the proxy connects to the server (this program) using WebSocket.
# Setup
The server needs to be able to listen on port 443
The server needs to be able to listen on port 80
in order to generate its TLS certificates.
On Linux, use the `setcap` program to enable
the server to listen on port 443 without running as root:
the server to listen on port 80 without running as root:
```
setcap 'cap_net_bind_service=+ep' /usr/local/bin/snowflake-server
```
@ -48,12 +48,11 @@ The server will cache TLS certificate data in the directory
`pt_state/snowflake-certificate-cache` inside the tor state directory.
In order to fetch certificates automatically,
the server needs to listen on port 443.
the server needs to listen on port 80,
in addition to whatever ports it is listening on
for WebSocket connections.
This is a requirement of the ACME protocol used by Let's Encrypt.
If your `ServerTransportListenAddr` is not on port 443,
the server will open an listener on port 443 in addition
to the port you requested.
The program will exit if it can't bind to port 443.
The program will exit if it can't bind to port 80.
On Linux, you can use the `setcap` program,
part of libcap2, to enable the server to bind to low-numbered ports
without having to run as root: