i2p.www/i2p2www/pages/site/get-involved/guides/reseed.html

{% extends "global/layout.html" %}
{% block title %}{{ _('How to Set up a Reseed Server') }}{% endblock %}
{% block lastupdated %}{% trans %}December 2015{% endtrans %}{% endblock %}
{% block content %}

<h2>{% trans %}Overview{% endtrans %}</h2>

<p>{% trans -%}
Thank you for volunteering to run an I2P reseed server.
"Reseeding" is our term for bootstrapping new routers into the network.
New routers fetch a bundle of peer references, or "router infos", from one or more of a hardcoded list of HTTPS URLs.
{%- endtrans %}</p>

<h2>{% trans %}Requirements{% endtrans %}</h2>

<p>{% trans -%}
At its simplest, a reseed server consists of a Java I2P router, an HTTPS web server,
and some scripts that periodically gather router infos from the router,
bundle and sign them into a custom file format, and deliver these files over HTTPS.
In practice, it's a bit more complex, and a reseed operator must be fairly competent and attentive.
A reseed server is not appropriate for a residential internat connection. The complexities include:
{%- endtrans %}</p>

<ul>
<li>{% trans -%}
You must have a secure SSL setup with either a self-signed certificate or a cert that chains up to a standard CA
{%- endtrans %}</li>
<li>{% trans -%}
The SSL configuration must conform to current best practices on allowed ciphers and protocols, and the CN/SAN host name must match the URL
{%- endtrans %}</li>
<li>{% trans -%}
The scripts are designed to deliver different router info bundles to different requestors for nextwork diversity
{%- endtrans %}</li>
<li>{% trans -%}
The scripts are designed to deliver the same bundle to the same repeated requestor to prevent scraping
{%- endtrans %}</li>
<li>{% trans -%}
The reseed servers are under periodic attacks and DDoS attempts, and from buggy botnet i2pd routers.
This necessitates that you run fail2ban or an equivalent solution.
{%- endtrans %}</li>
</ul>

<h2>{% trans %}Information Required{% endtrans %}</h2>

<p>{% trans -%}
When your setup is complete and ready for testing, we will need the HTTPS URL,
the SSL public key certificate, and the "su3" bundle public key.
After testing is complete, these will be added to the hardcoded entries in the Java and C++ routers in the next release,
and you will start seeing traffic.
We also will need your email address so we may continue to contact you about reseed administration issues.
The email will not be made public but will be known to the other reseed operators.
You should expect that your nick or name and its association with that URL or IP will become public.
{%- endtrans %}</p>

<h2>{% trans %}Privacy Policy{% endtrans %}</h2>

<p>{% trans -%}
A reseed operator is a trusted role in the network.
While we do not yet have a formal privacy policy, you must ensure the privacy of our users
by not publicizing logs or IPs found in those logs, except as necessary to discuss administration issues with the I2P reseed team.
{%- endtrans %}</p>

<h2>{% trans %}Getting Started{% endtrans %}</h2>

<p>{% trans -%}
Our reseed coordinator is "backup" and he may be contacted at backup@mail.i2p or backup at i2pmail.org.
Unfortunately, he is not generally on IRC. The reseed setup is somewhat specialized, and you should direct most questions to him.
{%- endtrans %}</p>

<p>{% trans -%}
For actual implementation, details are at the links below. In summary, there are two solutions we have to offer:
{%- endtrans %}</p>

<ol>
<li>{% trans -%}
A Go implementation that includes the web server and all the scripts. This is the recommended solution.
{%- endtrans %}</li>

<li>{% trans -%}
An older PHP implementation plus some shell scripts. The PHP goes into a web server that you must set up separately.
{%- endtrans %}</li>
</ol>

<p>{% trans -%}
For further information, read the information at the following links, and then contact backup.
Thank you!
{%- endtrans %}</p>

<ul><li>
<a href="http://zzz.i2p/topics/1893">zzz.i2p thread</a>
</li><li>
<a href="http://zzz.i2p/topics/1716">zzz.i2p thread</a>
</li><li>
<a href="https://github.com/MDrollette/i2p-tools">Go reseed server source on github</a>
</li><li>
<a href="/en/docs/spec/updates">SU3 Reseed File Format Sspecification"</a>
</li></ul>

<h2>{% trans %}Detailed Instructions{% endtrans %}</h2>

<pre>


-------------------------------------------------------------------------------
2015-05-09 backup
 * new chapter: reverse-proxy setup (idea by kytv and review from matt)
 * ==> howto_public_reseed_server_v6.txt

2015-03-23 backup (with much help from matt)
 * Script - su3.php - added support for running INSIDE i2p-net (DESTB32)
 * Script - su3.php - added proper html header for downloading in any browser
 * Script - cronjob_i2p.sh - minor code cleanups
 * Script - cronjob_i2p.sh - added FINAL CHECK number su3-files
 * new chapter: Optional - setup a manual reseed method, secured by captcha
 * new chapter: matt's go solution - Overview
 * new chapter: matt's go solution - Building from source
 * new chapter: matt's go solution - Run the reseed server
 * new chapter: matt's go solution - Draft for startup script
 * new chapter: matt's go solution - Convert existing java keystore to crt- and pem-file
 * ==> howto_public_reseed_server_v5.txt

2015-01-22 backup	
 * Script - cronjob_i2p.sh - minor code cleanups with shell script validator/parser
 * Script - su3.php - minor code cleanup (404 redirect), thanks to "drgr33n"
 * we want only HTTPS accessible reseed server
 * Testings - added some wget options for the ssl-certificate, thanks to "drgr33n"
 * ==> howto_public_reseed_server_v4.txt

2014-12-26 backup
 * Script - cronjob_i2p.sh - config variable "target" without ending "/"
 * meeh completely removed in contacts
 * new chapter: reseed server domain/url/port exchange
 * chapter "requirements" expanded - traffic volume, attacks, webserver-port!=443
 * chapter "Create self-signed ssl-certificate" - use rsa, not ecdsa
 * ==> howto_public_reseed_server_v3.txt

2014-12-13 backup
 * new chapter: Create self-signed ssl-certificate
 * new chapter: Seamless ssl-cert exchange
 * meeh's solution removed
 * cronjob_i2p.sh: example target path changed to "/var/www/su3/" for clarification
 * ==> howto_public_reseed_server_v2.txt

2014-10-17 backup
 * initial release v1




-------------------------------------------------------------------------------
How-to Public reseed servers - su3

- Some parts of this how-to are copied from http://zzz.i2p and are modified.
- Fetching individual RI (dat-files -the legacy/old style-) is not part of this how-to.
- Questions can be placed on http://zzz.i2p/forums/18 - in the Reseeding sub-forum.




-------------------------------------------------------------------------------
0. Table of contents

1. Intro
2. Requirements
3. Short overview
4. su3-file guidelines for reseeding
5. How to prepare your key pair for su3-files
6. su3 server-side implementation
7. unix shell script for cronjob
8. Setup cronjob
9. php script for webserver
10. url rewrite rule for webserver
11. Create self-signed ssl-certificate
12. Seamless ssl-certificate exchange
13. reseed server domain/url/port exchange
14. Testings
15. Contact reseed maintainer
16. Script - cronjob_i2p.sh
17. Script - su3.php
18. Optional - setup a manual reseed method
19. matt's go solution - Overview
20. matt's go solution - Building from source
21. matt's go solution - Run the reseed server
22. matt's go solution - Draft for startup script
23. matt's go solution - reverse-proxy setup
24. matt's go solution - Convert existing java keystore to crt- and pem-file




-------------------------------------------------------------------------------
1. Intro

Public reseed servers are necessary to bootstrap into the i2p net.
New installed i2p routers needs one-time a handful RouterInfo's (RI) as jump start.

RI contains IP and Port from other i2p-routers and are stored in dat-files in the netDB folder.

A random bunch of dat-files from the netDB are zipped, then signed to a su3-file
and finally offered to i2p-routers seeking reseed service.

To secure bootstrap and enable a trusted start, HTTPS/TLS and signed su3-files are mandatory.

It is essential not to publish all RI from netDB, or all RI to one client.
So a cronjob will be setup providing only a part of all available RI.

A php script ensures that requests to the public reseed server provides only
one su3-file within 24h for one client IP.




-------------------------------------------------------------------------------
2. Requirements

Requirements for running a public reseed server:
- well integrated running i2p router @ 24/7
- server with static IPv4 (2 cpu/ 2GB ram is already fine)
- unix to run the shell script, cronjobs or matts solution
- own domain, a third level domain is fine too and may provide you with more anonymity.
- a self signed ssl-certificate is ok
- web-space (HTTPS only) with php5+rewrite-rule
- HTTPS only, with TLS 1.2, only with good ciphers
- enough bandwidth and traffic volume (due to a annoying botnet expect up to 1TB per month)
- fail2ban to protect you from the botnet

This How-to is tested with Ubuntu/Debian
The web-space has to be public reachable from all over the world, an eepsite inside i2p can be setup in addition.
Also frequent or infrequent attempts to scrape all your reseed files, and of course attacks on your server.
The webserver doesn't need to listen at default SSL/TSL port 443 - any other port can be used for obfuscation.




-------------------------------------------------------------------------------
3. Short overview

- permanent: run your i2p router
- once: generate a private and public key pair for signing the reseed files
- once: setup the php script on the web-space
- once: setup a rewrite rule at webserver (*.su3 --> su3.php)
- regularly: run the unix shell script to generate up-to-date su3-files
- regularly: transfer su3-files to local /var/www/ or with (s)ftp to your remote web-space




-------------------------------------------------------------------------------
4. su3-file guidelines for reseeding

(From http://zzz.i2p/topics/1648)
- The su3-file must be named "i2pseeds.su3"
- The file must be in the same directory as the routerinfos on the web server
- Router will first try to fetch (index url)/i2pseeds.su3;
  if that fails it will fetch (index url) and then fetch the individual RI files, old-style
- Once a reseed from a host succeeds, it won't try any other URLs from that host
  (either http or https, ignoring ports... ports are now implemented)
- RI files in the zip file (in the su3-file) must be at the "top level",
  i.e. no directories in the zip file
- su3 content type must be RESEED (-c 3 or -c RESEED)
- su3 signature type should be RSA 4096 (-t 6 or -t RSA_SHA512_4096).
  If you're very low on CPU power you could use a shorter key, but you only need to do the signing process once a day or so.
  Any sig type will work, but RSA 4096 is the best in this case.
- Of course we must have your su3 signing public key checked in
  under the same name as you are using in the signing process,
  e.g. for you@mail.i2p the file name must be you_at_mail.i2p.crt, in the certificates/reseed/ directory




-------------------------------------------------------------------------------
5. How to prepare your key pair for su3-files

( from http://zzz.i2p/topics/1643)
Details are posted here from zzz: http://zzz.i2p/topics/1473
Who? All owner of a public reseed server.
Why? su3 reseed files will be signed with your private key.
This ensures a secure bootstrap for i2p routers.
Corresponding public keys will be included in i2p router package.
Example to create your key pair:
	su - i2puser
	I2P=/home/i2puser/i2p
	cd $I2P
	java -cp $I2P/lib/i2p.jar net.i2p.crypto.SU3File keygen -t RSA_SHA512_4096 backup_at_mail.i2p.crt keystore.ks backup@mail.i2p
Short usage help:
	SU3File keygen [-t type|code] publicKeyFile keystore.ks you@mail.i2p
Get more help:
	java -cp $I2P/lib/i2p.jar net.i2p.crypto.SU3File
Provide a strong password for your private key.
In this example two new files will be created in the working folder:
- backup_at_mail.i2p.crt	will contain the public key
- keystore.ks			is the Java keystore file and contains your private key
Backup and store public key, private key and your password!
Remember also the used key size/type when not using default RSA_SHA512_4096.
Send the public .crt key file to us, to include it into i2p/certificates/reseed/
If you have mtn privs, you may check the (you)_at_mail.i2p.crt file directly into installer/resources/certificates/reseed .
The file name must be (email address used for signing).crt, with "@" replaced with "_at_".
There is no requirement that it be xxx@mail.i2p, any email is fine, or for that matter any identifier.




-------------------------------------------------------------------------------
6. su3 server-side implementation

(from http://zzz.i2p/topics/1647)
This describes a mechanism for creating and distributing the RI in new su3 format.
It's independent from legacy way of doing (fetching dat-files) and can be used in parallel.
This idea don't need mysql, only some Unix shell tools and a simple web-space with php works fine.

A requesting client gets ~75 RI packed into one zip, signed and converted to a su3-file.
Don't provide unlimited RI to one clients.
But don't try to keep track of million client IP's in a database, e.g think of ipv6.
Keep it simple: make a fix n:m one-direction matching: n*ip --> m*su3-file by modulo.
n is the unlimited IPv4+IPv6 address space, and m are e.g. 100 pre-calculated su3-files.
A client with one IP gets always the same su3-file, until the su3-file is updated or the client has a new IP.
A number of clients (n/m ratio) gets the same su3-file - the same set of RI, so m is subject to be monitored in i2p net grow.

Once or twice a week (or daily): pre-calculate ~100 new su3-files, each includes ~75 RI.
The RI are fetched from a well running i2p router's netdb directory.
Transfer the pre-calculate su3-files to your web-space, e.g. by sftp or copy them locally to /var/www/su3/.
In the web-space a php script will match one client IP to one of the 100 su3-files by hash+modulo.
This has the advantage to split su3-generation and publishing in web-space .

Requirements for su3-file generation:
- 24/7 running i2p-router with up to date netdb
- ziptool, e.g. "zip" (Debian/Ubuntu: sudo apt-get install zip)
- Unix shell: find, awk, cat, ...
- your reseed keys: e.g. backup_at_mail.i2p.crt + keystore.ks + password
Requirements for web-space :
- php5
- rewrite rule (*.su3 --> php)

The following solution for a public reseed server consists of three parts:
- unix shell script for cronjob
- php script
- url rewrite rule
They are described on the following chapters in more detail.




-------------------------------------------------------------------------------
7. unix shell script for cronjob

This script pre-calculates n su3-files.
Requirements: unix shell, java, i2p, zip-tool, your private reseed signing key
Main Steps:
# CONFIG
# CHECK REQUIREMENT
# CREATE index files from netdB: use only 66% and max. 10h old
# CREATE zip files
# CREATE su3 files
# FINALIZE
Please check and edit #CONFIG sections, please review code before use.
The resulting su3-files are placed in the "target" folder which can be changed in config section with "target".
Configure file permissions and file owner e.g. 'www-data' - see deactivated example lines.
The cronjob script runs ca. 10 seconds for generating 100 pre-calculated su3 files on a modern cpu.
The number of dat-files per su3 package is random. If you configure 75, it results in ca. 50...100 dat-files per su3-file.
The number of generated su3-files is random too, it depends on your netdb size and adapts automatically:
- 1000 netdb entries: used for publishing:  ~666, results in  ~66 su3-files, each with ~75 dat-files
- 3000 netdb entries: used for publishing: ~1999, results in ~199 su3-files, each with ~75 dat-files
Only 66% of all RI from your netdb are used, netdb may be not older than 10h.
It is possible to separate cronjob script from php script:
Run the cronjob script on your i2p machine and then transfer the final su3-files via (s)ftp/ssh
to your webserver from time to time. su3 file-size in this setup is between 50 and 100 KB per file.




-------------------------------------------------------------------------------
8. Setup cronjob

Please add a cronjob, e.g. to run it every few days.
Add the shell script in crontab, e.g.:
	crontab -e
	23 59 * * * /usr/local/bin/cronjob_i2p.sh
The hard limit for the su3-file age is 30 days.
Recommendation is to update the su3-files once every 1..10 days.




-------------------------------------------------------------------------------
9. php script for webserver

The su3.php script maps always one client IP to one pre-calculated su3-file.
Requirements: a webserver with php5
Main Steps:
# CONFIG
# HEALTH CHECK
# COUNT su3 files
# MAPPING Client IP to one SU3
# PROVIDE SU3
Please check and edit #CONFIG sections, please review code before use.

The date() function in the salt ensures a rotate once a day, even if su3-files are not updated daily.
To avoid scraping from attackers with big IPv4 subnet resources
(or even IPv6) some lower bytes of the client IP address are discarded:
- IPv4:  4 byte  --> 1 lowest byte
- IPv6: 16 bytes --> 8 lowest bytes
Clients in the same "subnet" gets the same su3-file

A clients gets only different su3-file package in following circumstances:
- when he gets a new IP (respecting the discarded bytes in the IPv4/v6 address)
- at 00:00 every date (date function in php)
- when the unix cronjob updates the su3 files





-------------------------------------------------------------------------------
10. url rewrite rule for webserver

It is mandatory that clients does not have direct access to the su3-files at the webserver.
Please activate a rewrite rule for su3-files in your webserver pointing to the su3.php file:
	*.su3 --> su3.php?file=$1

Apache in ".htaccess":
	Options +FollowSymlinks
	RewriteEngine On
	RewriteRule ^(.*\.su3)$ /su3.php?file=$1 [L]

lighttpd in "/etc/lighttpd/lighttpd.conf":
	server.modules += ( "mod_rewrite" )
	url.rewrite-once = ( "^(.*\.su3)$" => "/su3.php?file=$1" )

We want only HTTPS accessible reseed server.
Sorted by best solution:
 * please deactivate plain HTTP, or
 * use a redirect rule in your webserver, or
 * implement the redirect to HTTPS in the php-code




-------------------------------------------------------------------------------
11. Create self-signed ssl-certificate

How-to generate a new self-signed ssl-certificate for HTTPS/TLS with openssl.
Example command line in Debian/Ubuntu for your.server.com:

$ openssl req -x509 -nodes -days 1500 -newkey rsa:4096 -sha256 -keyout your.server.com.pem -out your.server.com.pem
...
Country Name (2 letter code) [AU]:UK
State or Province Name (full name) [Some-State]:your.server.com
Locality Name (eg, city) []:your.server.com
Organization Name (eg, company) [Internet Widgits Pty Ltd]:your.server.com
Organizational Unit Name (eg, section) []:your.server.com
Common Name (e.g. server FQDN or YOUR name) []:your.server.com
Email Address []:your.server.com

--> The result is stored in "your.server.com.pem" file

Remarks:
- Please fill out all fields, don't use blanks
- rsa:4096 - key size, do not use 1024, you can use 2048 bits too, impact on server cpu
- use rsa, not ecdsa (ecdsa will break currently RetHat users)
- days 1500 - validity period in days (choose at will between 1100-2000 (3-5 years))
- sha256 - important, without this option openssl currently uses weak sha1 by default
- Do NOT reveal the private .pem key file to anyone - keep it save - keep a backup.

Next step:
- Open the created pem-file with a simple text editor.
- You see the section with the private key and the section with the public key.
- Copy the public section (starting with -----BEGIN CERTIFICATE-----) to another new file
- and save the new file as your.server.com.crt file
--> Send this to us - the .crt file with the public key section will we included in every i2p router.
--> The .pem file with your private key is only for you and your webserver.




-------------------------------------------------------------------------------
12. Seamless ssl-certificate exchange

The update/exchange of an already existing self-signed certificates has to be correct timed
on server *and* client side. Considering thousands of clients (many with older i2p version) the exchange
will not be seamless possible and will have very bad impact on many clients: reseed won't work for them.

To avoid this issue and make the exchange as smooth as possible follow these simple steps:

1. generate a new ssl-certificate NOW, but do NOT implement it on server
2. send the new ssl-certificate to us to perform a roll-out towards clients NOW
3. WAIT some month, e.g. 3-4 i2p-releases
4. new ssl-certificate is now hopefully present on many clients (in parallel to the current/old one)
5. THEN exchange the ssl-certificate on server

This idea based on the fact, that you can provide in i2p/certificates/ssl more than one crt-file for a server, e.g.
server.com.crt and server.com2.crt




-------------------------------------------------------------------------------
13. reseed server domain/url/port exchange


You are already operating a reseed server but want to change your domain/url/port?
To make the exchange as smooth as possible for many clients please follow these steps if possible:

a) Setup an additional reseed instance at the new domain/url/port
b) we include the new url into i2p source NOW and delete the old url NOW
c) both of your reseed instances have to run some time in parallel
d) WAIT some month, e.g. 3-4 i2p-releases
e) new url is now hopefully present on many clients
f) THEN shutdown the old reseed instance




-------------------------------------------------------------------------------
14. Testings

Some simple pre-test: test the website and fetch
	wget --user-agent="Wget/1.11.4" -O /tmp/test.su3 --no-check-certificate https://your-server.com:PORT/i2pseeds.su3
Replace "PORT" with default 443 or your chosen server setting.
Inspect the fetched file:
	zipinfo -z /tmp/test.su3

Replace "--no-check-certificate" with "--ca-certificate=~/i2p/certificates/ssl/your-server.com.crt"
which contains the path to your local public ssl-certificate to check also your ssl-certificate chain.

Everything ok:
- ssl-certificate chain valid?
- The su3-files can be downloaded?
- contains >50 dat-files?
- and is always the same for one client-IP?
- other client-IP's gets another file?
- Clients has no direct access to complete folder e.g. https://your-server.com/su3/ ?

Do a real reseed test on *another* i2p router machine:
- include manually new ssl-certificate into i2p installation:	~/i2p/certificates/ssl/
- include manually new public reseed key into i2p installation:	~/i2p/certificates/reseed/
- http://localhost:7657/configreseed --> remove all reseed hosts
- add the new reseed host e.g. "https://your-server.com/" *without* trailing "i2pseeds.su3"
- Save and Shutdown router.
- clear netdb: empty folder ./i2p/netDb.
- Restart i2p and watch the i2p router log:
2014/10/13 23:01:02 | Reseed start
2014/10/13 23:01:02 | Reseeding from https://your-server/i2pseeds.su3
2014/10/13 23:01:05 | INFO: xx files extracted to /tmp/i2p-V2qudTbd.tmp/reseeds-1010682701
2014/10/13 23:01:05 | Reseed got xx router infos from https://your-server.com/i2pseeds.su3 with 0 errors
2014/10/13 23:01:06 | Reseed complete, xx received




-------------------------------------------------------------------------------
15. Contact reseed maintainer

Contact us per email backup@mail.i2p (fallback is killyourtv@mail.i2p or the reseed section at zzz's forum)
Provide us details about the new
 - reseed website url,
 - public part of ssl-certificate
 - public su3-key
 - your contact email
Feel free to contact backup@mail.i2p in case of questions or problems or post your question at zzz's forum in the reseed section.




-------------------------------------------------------------------------------
16. Script - cronjob_i2p.sh

###############################################################################
#!/bin/sh
version="v5"


# CONFIG
I2P="${HOME}/i2p"			# i2p installation directory
source="${HOME}/.i2p/netDb"		# valid netdb
target="${HOME}/i2pseeds.su3"		# location for the final su3-files

key_keystore="${I2P}/keystore.ks"	# your private su3 reseed key
key_password="secret"			# your password for private key of keystore.ks
key_email=yourmail@mail.i2p		# your email id for reseeding
key_type=RSA_SHA512_4096		# your key size/type for reseeding (DO NOT EDIT, unless you know why)

tool_zip="/usr/bin/zip"			# install a "zip" tool: sudo apt-get install zip
tool_i2p="$I2P/lib/i2p.jar"		# should be already there


# CONFIG (DO NOT EDIT)
ri_seed=75				# average number ri per su3-file (DO NOT EDIT)
stamp=$(date +%s)			# unique id (DO NOT EDIT)
target_tmp="/tmp/i2pseeds.${stamp}.tmp"	# temp folder with unique id (DO NOT EDIT)


# CLEAN /tmp/i2pseeds.*
find /tmp -type d -iname 'i2pseeds.*.tmp' -exec rm -rf {} \;
mkdir --parents "${target_tmp}"


# CHECK REQUIREMENT
[ ! -d "${I2P}" ]          && echo "ERROR1: path not found: ${I2P}"          && exit 1
[ ! -d "${source}" ]       && echo "ERROR2: path not found: ${source}"       && exit 1
[ ! -d "${target_tmp}" ]   && echo "ERROR3: path not found: ${target_tmp}"   && exit 1
[ ! -x "${tool_zip}" ]     && echo "ERROR4: command not found: ${tool_zip}"  && exit 1
[ ! -f "${tool_i2p}" ]     && echo "ERROR5: file not found: ${tool_i2p}"     && exit 1
[ ! -f "${key_keystore}" ] && echo "ERROR6: file not found: ${key_keystore}" && exit 1


# CREATE index-files from netdB: use only 66% and max. 10h old
find "${source}" -type f -mmin -600 -name 'routerInfo-*.dat' | awk -v ri_seed="${ri_seed}" -v target_tmp="${target_tmp}" '
	BEGIN { ri_all=0; }
	{	data[ri_all++]=$0; }
	END {	srand();
		ri_use=ri_all*0.6666;
		ri_su3=int(ri_use/10);
		stepy=ri_use/ri_all;
		stepx=ri_seed/ri_use;
		for (y=0;y<ri_all; y++) if (rand()<=stepy) {
			for (x=0; x<ri_su3; x++) if (rand()<=stepx) {
				file=target_tmp"/"x".index";
				print data[y] >> file
			}
		}
	}'


# CREATE zip-files from index-files
find "${target_tmp}" -type f -name '*.index' | sort | while read i; do
	"${tool_zip}" --update --quiet --junk-paths "${target_tmp}/$(basename "$i" .index)" -@ < "$i"
done


# CREATE su3-files from zip-files
echo "${key_password}" | java -cp "${tool_i2p}" net.i2p.crypto.SU3File bulksign -c RESEED -t "${key_type}" "${target_tmp}" "${key_keystore}" "${stamp}" "${key_email}"


# REMOVE index-files and zip-files
find "${target_tmp}" -type f -name '*.index' -exec rm -f "{}" \;
find "${target_tmp}" -type f -name '*.zip'   -exec rm -f "{}" \;


# FINAL CHECK number su3-files
c_su3=$(find "${target_tmp}" -type f -mmin -600 -name '*.su3' | wc -l)
[ "${c_su3}" -lt 25 ] && echo "ERROR7: less than 25 su3 files found: ${c_su3}" && rm -Rf "${target_tmp}" && exit 1
echo "Created: $target_tmp ${c_su3} x${ri_seed}"


# MOVE su3-files to target
chmod 755 "${target_tmp}" -R
rm -fr "${target}.old"
mv -f  "${target}"     "${target}.old"
mv -f  "${target_tmp}" "${target}"
rm -fr "${target_tmp}"


# EXIT
echo      "$(basename "$0")" "${version} ${target} ${c_su3} x${ri_seed}"
logger -t "$(basename "$0")" "${version} ${target} ${c_su3} x${ri_seed}"
exit 0
###############################################################################




-------------------------------------------------------------------------------
17. Script - su3.php

###############################################################################
<?php
$version="v5";


# CONFIG
$path_su3="/home/i2p/i2pseeds.su3";		# path to pre-calculated su3 files
$salt="change_to_something";			# change salt to something random
$salt=$salt . date("Y-m-d");			# date() ensures a rotate once a day, even if su3 are not updated daily (DO NOT EDIT)
$file_su3  = "i2pseeds.su3";			# static (DO NOT EDIT)
$user_agent= "Wget/1.11.4";			# static (DO NOT EDIT)


# INSIDE i2p-net ? If yes: convert DESTB32 into pseudo IPv6 as valid REMOTE_ADDR
if (	$_SERVER["REMOTE_ADDR"]=="127.0.0.1"
	&& isset($_SERVER["HTTP_X_I2P_DESTB32"])
  ) {	$_SERVER["REMOTE_ADDR"]=inet_ntop(substr(md5($_SERVER["HTTP_X_I2P_DESTB32"]),0,16)); }


# HEALTH CHECK 1
if (	!isset($_SERVER['HTTP_USER_AGENT'])
	|| !isset($_SERVER['REMOTE_ADDR'])
	|| !isset($_GET['file'])
    ) { header($_SERVER["SERVER_PROTOCOL"]." 404 Not Found", true, 404); die(); }


# COUNT su3 files
$count_su3 = count(glob($path_su3."/*.su3"));


# HEALTH CHECK 2
if (	empty($_SERVER['HTTP_USER_AGENT'])
	|| empty($_SERVER['REMOTE_ADDR'])
	|| empty($_GET['file'])
	|| (strcmp(basename($_GET['file']), $file_su3) != 0)
	|| (strcmp($_SERVER['HTTP_USER_AGENT'], $user_agent) != 0)
	|| !filter_var($_SERVER['REMOTE_ADDR'], FILTER_VALIDATE_IP)
	|| $count_su3<1
    ) { header($_SERVER["SERVER_PROTOCOL"]." 404 Not Found", true, 404); die(); }


# MAPPING Client IP to one su3-file
$remote_id = inet_pton($_SERVER['REMOTE_ADDR']);
$shrink=3; if (strlen($remote_id)>8) { $shrink=8; };
$remote_id = abs(crc32(md5(substr($remote_id,0,$shrink).$salt))) % $count_su3;
$file_id = $path_su3."/".$remote_id.".su3";


# HEALTH CHECK 3
if (!file_exists($file_id)) { header($_SERVER["SERVER_PROTOCOL"]." 404 Not Found", true, 404); die(); }


# PROVIDE su3-file
header('Content-Description: File Transfer');
header("Content-Type: application/zip");
header('Content-Transfer-Encoding: binary');
header('Content-Length: '.filesize($file_id));
header('Content-Disposition: attachment; filename='.$file_su3);
ob_clean(); flush();
if (!readfile($file_id)) { header($_SERVER["SERVER_PROTOCOL"]." 404 Not Found", true, 404); die(); }
exit;
?>
###############################################################################




-------------------------------------------------------------------------------
18. Optional - setup a manual reseed method

For some users the automated reseeding may not work.
This is an alternate way for users to get a valid reseed file with a normal web-browser,
e.g. from another machine or maybe a friend. It is secured by a captcha to prevent abuse.

With this optional code users can visit https://your.reseedserver.com/reseed.php
with any web-browser to download a su3-file after they solved the captcha.

Since 0.9.18-9 I2P has support to use reseed files from other sources:
http://localhost:7657/configreseed

Visit https://geti2p.net/en/faq#manual_reseed to read how it works for users and see some example url's.
[NOT DONE YET: read here: http://zzz.i2p/topics/1828-running-prototype-manually-reseed-captcha
or test here anonymously: http://reseed.i2p/open.php]

The changes for an exiting reseed server with the previous setup are simple:
- use the latest su3.php from above (minimal version 5, only minor changes, no change of logic).
- add the new reseed.php to your /var/www folder, next to to su3.php
- install php5-gd (restart of php processes may be necessary)
- get Securimage php-code from https://www.phpcaptcha.org/

Quote from https://www.phpcaptcha.org  (2015-03):
"Securimage is an open-source free PHP CAPTCHA script for generating complex images and CAPTCHA codes to protect
forms from spam and abuse. It can be easily added into existing forms on your website to provide protection from spam bots.
It can run on most any webserver as long as you have PHP installed, and GD support within PHP.
Securimage does everything from generating the CAPTCHA images to validating the typed code."

Short overview about installing Securimage:
 1. download at https://www.phpcaptcha.org/download/
 2. extract to /var/www/securimage
 3. download and extract the "Test Script" (securimage_test.php) from the same url
 4. test your server and visit https://.../securimage_test.php with your browser
The "Test Script" verifies your ability to run and display the captcha code, and can be deleted after the test.

The reseed.php contains only the captcha generation and verification of the users input. It is based on the
Quickstart Guide from Securimage. When the user solved the captcha, reseed.php sets two http variables and
then includes the external su3.php to start the su3-file download.

The name "reseed.php" is not fixed, you can name it unremarkable/unobtrusive as you like,
enter.php start.php go.php...
but you have to stick with it, when it is published :-)

reseed.php:
################################################################################################
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head><meta http-equiv="Content-Type" content="text/html;charset=utf-8"></head><body>
<?php
session_start();
include_once $_SERVER['DOCUMENT_ROOT'] . '/securimage/securimage.php';
$securimage = new Securimage();

if (!isset($_POST['captcha_code']) || $securimage->check($_POST['captcha_code']) == false) {?>
	<form method="post" action="<?php echo(basename($_SERVER['PHP_SELF'])); ?>">
	<img id="captcha" src="/securimage/securimage_show.php" alt="CAPTCHA Image" />
	<p>Enter Code: <input type="text" name="captcha_code" size="10" maxlength="6" />
	<input type="submit" value="Check Code" />
	</form>
<?php } else {
	$_SERVER['HTTP_USER_AGENT']="Wget/1.11.4";
	$_GET['file']="i2pseeds.su3";
	include_once $_SERVER['DOCUMENT_ROOT'] . "/su3.php";
} ?>
</body></html>
################################################################################################




-------------------------------------------------------------------------------
19. matt's go solution - Overview

The previous steps for reseeding involves many steps, scripts and programs.
Most of them are easy and plain straight forward, but overall you can call it a little confusing.

Here comes now an all-in-one solution from matt (Big Thanks!) for providing
a reseed server which merges the following functions into one binary:

- create su3-files
- create su3 signer certificate+key
- create ssl-certificate+key
- replaces the http-server and the php code (or run next to them in parallel)

Almost all previous used scripts and described steps are not needed with this solution,
but to understand the overall reseed process it is recommended to read them too :-)

 - If you already have an ssl-certificate and su3-signer-key you can reuse them, see one of the following chapter.
 - For testing and new reseeders the required certs and keys are created automatically at first start.
 - Also take a look at the content and the naming scheme of these pem and crt files.

Of course you need an up-to-date netDB folder with routerinfos from a running i2p router.
I2P does not have to be running on the same machine as this reseed binary.
In this case you can setup a cronjob to transfer the netDB from the I2P machine to the reseed machine.

Matt's go solution can be used in parallel next to an already running http-server.
For this leave the http-server running at normal port 80 and 443,
and configure matt's go solution too use another port, e.g. port 8443.

More: at github, README.md, https://github.com/MDrollette/i2p-tools


-------------------------------------------------------------------------------
20. matt's go solution - Building from source

Requirements:
 - go1.4.2 (older versions may not work)

Install go from https://golang.org/doc/install, example for 64 bit Ubuntu/Debian:
 - wget https://storage.googleapis.com/golang/go1.4.2.linux-amd64.tar.gz
 - sudo tar -C /usr/local -xzf go1.4.2.linux-amd64.tar.gz
 - mkdir $HOME/go
 - edit /etc/profile and add:
	export GOPATH=$HOME/go
	export PATH=$PATH:/usr/local/go/bin:$GOPATH/bin

Verify go:
$ go version
which should state something like: "go version go1.4.2"

Install matt's go solution from https://github.com/MDrollette/i2p-tools into $HOME/go:
$ go get github.com/MDrollette/i2p-tools

This will install a binary to $GOPATH/bin/i2p-tools

Run the go solution, the usage/help should be displayed, nothing more:
$ i2p-tools




-------------------------------------------------------------------------------
21. matt's go solution - Run the reseed server

$ i2p-tools reseed --tlsHost=myserver.com --signer=myemail@mail.i2p --netdb=$HOME/.i2p/netDb

- replace myserver.com with your real domain
- replace myemail@mail.i2p with a valid existing email, which you want to use for reseeding purpose
- new TLS certificate+key will be created (if they do not exist)
- new signing certificate+key will be created (if they do not exist)
- netdb=... should point to the netdb folder of your running i2p with the routerinfos
- to use another port append "--port=443" to the command, default is port 8443

Output:
2015/03/15 12:28:25 Rebuilding su3 cache...
2015/03/15 12:28:25 Building 200 su3 files each containing 75 out of 3180 routerInfos.
2015/03/15 12:28:35 Done rebuilding.
2015/03/15 12:28:35 HTTPS server started on 0.0.0.0:8443

So you can now test to reach the server at port 8443, see a previous chapter about proper testing.

Some remarks:
- don't run the server daemon as root
- every port between 1024 and 49151 is fine for i2p.
- if you want to use the privileged (https-default) port 443, create a port redirect, e.g.
    iptables -A PREROUTING -t nat -p tcp --dport 443 -j REDIRECT --to-port 8443
- redirect the output from the go solution to a logfile, format is default apache-style combined logs
- add a logrotate for the logfiles, since they grow big :-(
- logfiles can be used by fail2ban
- Both of the certificates (*.crt) will need to be sent to the reseed maintainer
in order for your reseed server to be included in the standard I2P package.
- Add a proper startup script, to run the reseed server, see next chapter




-------------------------------------------------------------------------------
22. matt's go solution - Draft for startup script

The reseed server should be started automatically, so you need a init.d or some sort of startscript.
This is only a very first draft for a simple startscript (it could be done better :-))
The startscript can be placed in your personal crontab: @reboot   sleep 20 && /path_to/startscript


Two logfiles are specified:
 * reseed.log - apache-style combined logs
 * reseed.error	- any error messages

startscript:

######################################################################################################
#!/bin/sh

export HOME=/home/i2puser
export GOPATH=$HOME/go
export PATH=$PATH:/usr/local/go/bin:$GOPATH/bin

cd $GOPATH
logfile=$HOME/go/reseed.log
errfile=$HOME/go/reseed.error

i2p-tools reseed --tlsHost=myserver.com --signer=myemail@mail.i2p --netdb=$HOME/.i2p/netDb >>$logfile 2>>$errfile &
disown -h

exit 0
######################################################################################################




-------------------------------------------------------------------------------
23. matt's go solution - reverse-proxy setup

You can run i2p-tools also behind your normal web-server (reverse-proxy).

The web-server handles the TLS handshake, encryption, SSL Certificate and the logfiles.
But you don't need the scripts su3.php and the shell cronjob for creating su3-files.
i2p-tools is running "behind" the web-server, without TLS management, only bind to
local interface 127.0.0.1 and is handling complete building and handling of su3-files.


Run i2p-tools with this command:

i2p-tools reseed --signer test@test.de --key /path_to/test_at_test.de.pem --netdb /path_to/netDb --port=8443 --ip 127.0.0.1 --trustProxy

Important notes for this special setup:
 * do *not* specify  --tlsHost, --tlsCert or --tlsKey on the command-line
 * "ip 127.0.0.1" binds the program only to local interface
 * "trustProxy" uses the "X-Forwarded-For" to get the real client IP


lighttpd configuration example:
	server.modules += ( "mod_proxy" )
	proxy.server = ( ".su3" => ( ( "host" => "127.0.0.1", "port" => 8443 ) )  )


nginx configuration example:
	location / {
		proxy_pass http://127.0.0.1:8443;
	}

and for X-Forwarded-For:
     proxy_set_header        X-Real-IP       $remote_addr;
     proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;




-------------------------------------------------------------------------------
24. matt's go solution - Convert existing java keystore to crt- and pem-file

This describes how to convert your existing java keystore with your su3 signing key to a plain crt- and pem-file.
This is only needed, when you already have a java keystore and want to use matt's go solution.
If you create new keys+certs with matt's solution you can skip this chapter!

Requirements:
 * java keytool
 * openssl
 * and of course your secret password for the keystore

Keep in mind: the java keystore has two passwords:
 * the secret key password you have entered while creating your keystore the first time (SU3File keygen ...)
 * and a "storage" password, which is most probably default "changeit".

This works in a Ubuntu/Debian shell:

######################################################################################################
file="keystore.ks"
pass_jks=changeit

# List the keystore content, show the included (email) alias
keytool -list -storepass $pass_jks -keystore $file

# Convert jks --> pkcs12, specify the correct email alias (xxxxx@mail.i2p):
keytool -importkeystore -srcalias xxxxx@mail.i2p -srckeystore $file -srcstoretype jks -srcstorepass $pass_jks -destkeystore ${file}.p12  -deststoretype pkcs12 -deststorepass $pass_jks -destkeypass $pass_jks

# Show the pkcs12 content:
openssl pkcs12 -passin pass:$pass_jks -in ${file}.p12 -nodes -info

# Convert pkcs12 --> pem
openssl pkcs12 -passin pass:$pass_jks -in ${file}.p12 -nodes -out ${file}.pem

# Decrypt the pem
openssl rsa  -in ${file}.pem -out xxxxx_at_mail.i2p.pem

# Extract the certificate
openssl x509 -in ${file}.pem -out xxxxx_at_mail.i2p.crt
######################################################################################################


</pre>

{% endblock %}