Add {client,server}_bridge_fn

Add the variables client_bridge_fn and server_bridge_fn that will be
called in bridge instead of always calling bridge_client and
bridge_server.

This will be used for those times where bridging is not the correct
action to take when data is available, like during an TLS/SSL handshake.
Add passive handlers

passive handlers can be created through the handler.passive decorator.
Their return values will be ignored and should be safe to add to all
connections.

Adding the decorator to all current passive handlers and improving the
handler selection will come in a later commit.
Make all passive handler use handler.passive
Make data selection use probability

Previously data handlers were all or nothing, but that doesn't work
well. Now we have passive handlers being run 100% of the time, since
they do nothing potentially destructive to a connection. For active
handlers we use the same probability as for connections and with
probability p we use all the selected active handlers, with 1-p we use
none of them.

We might later expand this to have per handler probability/selection,
but that gets complicated fast.

Fixes #20
Make most data handlers on by default

Since data attacks now have probability of happening we don't need to
leave destructive handlers off by default.

Only the client specified custom detection and the overly destructive
blockhttp are still defaulted to off.
Add Android app to test nogotofail MiTM.

This adds an Android application which offers an easy way to generate
vulnerable traffic which should be detected by the MiTM. This should
be useful for quickly testing the various attack/detection
functionality of the nogotofail MiTM.

This commit adds a small number of tests to cover the most typical
vulnerable traffic: HTTPS requests where the identity of the server is
not fully verified, and cleartext HTTP requests with an Authorizaton
header which thus leaks authentication credentials. More tests will be
added later.

Fixes #21
Install dhparam into /opt/nogotofail.

The MiTM daemon is failing without this file because it needs
to load DH parameters from this file for each TLS/SSL connection
being MiTM'd.

Fixes #25.
Merge pull request #26 from google/fix-dhparams-on-gce

Install dhparam into /opt/nogotofail.
Merge pull request #24 from google/mitm-tester

Add Android app to test nogotofail MiTM.
Merge pull request #23 from google/data_probability

Select data handlers with probability
Properly blackhole IPv6 traffic in GCE + OpenVPN setup.

This fixes two issues:
1. Custom built dnsmasq did not overwrite the original dnsmasq.
   As a result, AAAA DNS lookups returned non-empty results letting
   clients resolve DNS names to IPv6 addresses.
2. OpenVPN server wasn't assigned an IPv6 address and thus didn't
   correctly push IPv6 settings to clients.

Fixes #28
Merge pull request #29 from google/fix-gce-openvpn-ipv6

Properly blackhole IPv6 traffic in GCE + OpenVPN setup.
Fix the Android launcher icon master file.

The file was accidentally run through extraneous whitespace removal
tool.
Add image to be used by default for the imagereplace attack.
Merge pull request #34 from google/fix-android-launcher-icon

Fix the Android launcher icon master file.
Improve early CCS attack injection

Now the early CCS attack no longer injects a ServerHelloDone and instead
injects the remaining records as they are.

Also adds buffering for server responses to handle the case where a
partial read leaves a TLS record incomplete, this should prevent cases
where we fail to test a connection due to bad reads.
Fix incorrect arguments to disable_redirect_rules
Merge pull request #36 from google/routing_fix

Fix incorrect arguments to disable_redirect_rules
Add bridge_fns to connections.

This will allow us to easily override what function to call on a socket
having data ready.
Install the replace.png during setup on GCE