fix excess authority provided by "Control Port" (and private/control.furl)

[warner]

There's a little-used "control port" in the tahoe client, accessible through Foolscap by someone who can read NODEDIR/private/control.furl (which in practice means only the node admin). The original idea was to provide a Foolscap-based frontend with more features (or at least more security) than the HTTP-based frontend. But that never took off, and at this point, there are only two consumers:

• automated performance tests in source:src/allmydata/test/check_speed.py
• automated memory-footprint tests in source:src/allmydata/test/check_memory.py

The methods it provides are:

• wait_for_client_connections()
• upload_from_file_to_uri()
• download_from_uri_to_file()
• speed_test()
• get_memory_usage()
• measure_peer_response_time()

Daira argues that it provides excess authority, specifically due to the fact that the upload/download methods accept local filenames (like remote_upload_from_file_to_uri() which accepts a local disk filename and uploads it to the grid, returning the filecap, which could be used to upload e.g. ~/.tahoe/private/aliases. This makes it unsafe to share control.furl with anyone who is not supposed to get control of the user account running the node.

Daira would like to remove it. To do that, we'd need to either give up the automated performance and memory-footprint tests, or find a way to rewrite them (which would probably mean adding new authorities into the HTTP-based webapi, at least for get_memory_usage() and measure_peer_response_time()).

We could also address the excess authority by changing the upload/download methods (maybe using empty tempfiles of given sizes, and *not* accepting a filename at all). That would probably let us preserve the automated tests without too many changes.

[warner]

I've rewritten the memory test to use a different method (using randomly-generated tempfiles), and I've removed the troublesome filename-based upload/download methods. [2eea4e9] removed the methods, and [f0e783e] contains the fixed memory test.

The current list of control-port methods is:

• wait_for_client_connections(num_clients)
• upload_random_data_from_file(size, convergence)
• download_to_tempfile_and_delete(uri)
• speed_test(count, size, mutable)
• get_memory_usage()
• measure_peer_response_time()

[daira]

Will review.

[daira]

Reviewed; suggested a minor cleanup.

[warner]

cleanup applied in [341e263]

[Brian Warner <warner@…>]

In 341e263e0371b7d2157353aebd02af5cd1a54b0f/trunk:

control.py: minor improvements

refs ticket:1737