November 2019 - tor-commits - lists.torproject.org

[torbutton/master] Bug 30237: Add strings for v3 onion services client authentication
by gk＠torproject.org 19 Nov '19

19 Nov '19

commit fa05e61cac497a7fbe3050ee8a9f4f6ec39be3a4 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Nov 12 15:39:19 2019 -0500 Bug 30237: Add strings for v3 onion services client authentication --- chrome/locale/en-US/torbutton.dtd | 3 +++ chrome/locale/en-US/torbutton.properties | 10 ++++++++++ 2 files changed, 13 insertions(+) diff --git a/chrome/locale/en-US/torbutton.dtd b/chrome/locale/en-US/torbutton.dtd index d14bd1da..ed3cb1a6 100644 --- a/chrome/locale/en-US/torbutton.dtd +++ b/chrome/locale/en-US/torbutton.dtd @@ -47,3 +47,6 @@ <!ENTITY torbutton.prefs.sec_advanced_security_settings "Advanced Security Settings…"> <!ENTITY torbutton.circuit_display.title "Tor Circuit"> <!ENTITY torbutton.circuit_display.new_circuit "New Circuit for this Site"> + + +<!ENTITY torbutton.onionServices.authPrompt.tooltip "Open onion service client authentication prompt"> diff --git a/chrome/locale/en-US/torbutton.properties b/chrome/locale/en-US/torbutton.properties index ea7a7d63..1020e57a 100644 --- a/chrome/locale/en-US/torbutton.properties +++ b/chrome/locale/en-US/torbutton.properties @@ -58,3 +58,13 @@ updateDownloadingPanelUILabel=Downloading %S update # .Onion Page Info prompt. Strings are kept here for ease of translation. pageInfo_OnionEncryptionWithBitsAndProtocol=Connection Encrypted (Onion Service, %1$S, %2$S bit keys, %3$S) pageInfo_OnionEncryption=Connection Encrypted (Onion Service) + +# Onion services strings. Strings are kept here for ease of translation. +# LOCALIZATION NOTE: %S will be replaced with the .onion address. +onionServices.clientAuthMissing=Tor onion service missing client authorization +onionServices.authPrompt.description=%S is requesting your private key. +onionServices.authPrompt.keyPlaceholder=Enter your private key for this onion service +onionServices.authPrompt.done=Done +onionServices.authPrompt.doneAccessKey=d +onionServices.authPrompt.invalidKey=Please enter a valid key (52 base32 characters or 44 base64 characters) +onionServices.authPrompt.failedToSetKey=Unable to configure Tor with your key

1 0

[tor-browser/tor-browser-68.2.0esr-9.5-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 19 Nov '19

19 Nov '19

commit 548177579c14a34a72f374ec783005f04cfde100 Author: Alex Catarineu <acat(a)torproject.org> Date: Mon Oct 21 18:20:42 2019 +0200 fixup! TB4: Tor Browser's Firefox preference overrides. --- browser/app/profile/000-tor-browser.js | 58 ++++++++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 9f2537df5557..d02b4e13a2d9 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -347,6 +347,64 @@ pref("browser.download.forward_oma_android_download_manager", false); #expand pref("torbrowser.version", __TOR_BROWSER_VERSION_QUOTED__); +// Old torbutton prefs + +// debug prefs +pref("extensions.torbutton.loglevel",4); +pref("extensions.torbutton.logmethod",1); // 0=stdout, 1=errorconsole, 2=debuglog + +// Display prefs +pref("extensions.torbutton.display_circuit", true); +pref("extensions.torbutton(a)torproject.org.description", "chrome://torbutton/locale/torbutton.properties"); +pref("extensions.torbutton.updateNeeded", false); + +// Tor check and proxy prefs +pref("extensions.torbutton.test_enabled",true); +pref("extensions.torbutton.test_url","https://check.torproject.org/?TorButton=true"); +pref("extensions.torbutton.local_tor_check",true); +pref("extensions.torbutton.versioncheck_url","https://www.torproject.org/projects/torbrowser/RecommendedTBBVersions"); +pref("extensions.torbutton.versioncheck_enabled",true); +pref("extensions.torbutton.use_nontor_proxy",false); + +// State prefs: +pref("extensions.torbutton.startup",false); +pref("extensions.torbutton.inserted_button",false); +pref("extensions.torbutton.inserted_security_level",false); + +// This is only used when letterboxing is disabled. +// See #7255 for details. We display the warning three times to make sure the +// user did not click on it by accident. +pref("extensions.torbutton.maximize_warnings_remaining", 3); + +// Security prefs: +pref("extensions.torbutton.clear_http_auth",true); +pref("extensions.torbutton.close_newnym",true); +pref("extensions.torbutton.resize_new_windows",false); +pref("extensions.torbutton.startup_state", 2); // 0=non-tor, 1=tor, 2=last +pref("extensions.torbutton.tor_memory_jar",false); +pref("extensions.torbutton.nontor_memory_jar",false); +pref("extensions.torbutton.launch_warning",true); + +// Opt out of Firefox addon pings: +// https://developer.mozilla.org/en/Addons/Working_with_AMO +pref("extensions.torbutton(a)torproject.org.getAddons.cache.enabled", false); + +// Security Slider +pref("extensions.torbutton.security_slider", 4); +pref("extensions.torbutton.security_custom", false); + +pref("extensions.torbutton.confirm_plugins", true); +pref("extensions.torbutton.confirm_newnym", true); + +pref("extensions.torbutton.noscript_inited", false); +pref("extensions.torbutton.noscript_persist", false); + +// Browser home page: +pref("browser.startup.homepage", "about:tor"); + +// This pref specifies an ad-hoc "version" for various pref update hacks we need to do +pref("extensions.torbutton.pref_fixup_version", 0); + // If we are bundling fonts, whitelist those bundled fonts, and restrict system fonts to a selection. #ifdef MOZ_BUNDLED_FONTS

1 0

[tor-browser/tor-browser-68.2.0esr-9.5-1] fixup! Bug 25741 - TBA: Add mozconfig for Android and pertinent branding files.
by gk＠torproject.org 19 Nov '19

19 Nov '19

commit c2fafa4a2f8fa3ec005bafaab748861ecee49946 Author: Alex Catarineu <acat(a)torproject.org> Date: Wed Nov 13 12:47:29 2019 +0100 fixup! Bug 25741 - TBA: Add mozconfig for Android and pertinent branding files. --- mobile/android/app/000-tor-browser-android.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mobile/android/app/000-tor-browser-android.js b/mobile/android/app/000-tor-browser-android.js index 0017cb2d058a..db9e23063738 100644 --- a/mobile/android/app/000-tor-browser-android.js +++ b/mobile/android/app/000-tor-browser-android.js @@ -49,3 +49,6 @@ pref("intl.locale.requested", ""); // Disable WebAuthn. It requires Google Play Services, so it isn't // available, but avoid any potential problems. pref("security.webauth.webauthn_enable_android_fido2", false); + +// Disable the External App Blocker on Android +pref("extensions.torbutton.launch_warning", false);

1 0

[torbutton/master] Bug 30851: Move default preferences to 000-tor-browser.js
by gk＠torproject.org 19 Nov '19

19 Nov '19

commit 59cabca7ade54fa4f5fec2a398456dbc3891009a Author: Alex Catarineu <acat(a)torproject.org> Date: Mon Jun 10 17:49:38 2019 +0200 Bug 30851: Move default preferences to 000-tor-browser.js --- chrome/content/locale/non-localized.properties | 6 --- components/domain-isolator.js | 3 -- components/dragDropFilter.js | 2 - components/startup-observer.js | 1 - components/torbutton-logger.js | 2 - defaults/preferences/preferences.js | 55 -------------------------- jar.mn | 1 - modules/default-prefs.js | 36 ----------------- moz.build | 3 -- 9 files changed, 109 deletions(-) diff --git a/chrome/content/locale/non-localized.properties b/chrome/content/locale/non-localized.properties deleted file mode 100644 index dca78639..00000000 --- a/chrome/content/locale/non-localized.properties +++ /dev/null @@ -1,6 +0,0 @@ -# This file must be located in a subdirectory named "locale" so that -# about:config will display the correct value for browser.startup.homepage. -# See fetchPref() inside toolkit/components/viewconfig/content/config.js - -# Default home page -browser.startup.homepage=about:tor diff --git a/components/domain-isolator.js b/components/domain-isolator.js index f6a6d598..3ed6e58f 100644 --- a/components/domain-isolator.js +++ b/components/domain-isolator.js @@ -15,9 +15,6 @@ const { XPCOMUtils } = ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm let logger = Cc["@torproject.org/torbutton-logger;1"] .getService(Ci.nsISupports).wrappedJSObject; -let { ensureDefaultPrefs } = ChromeUtils.import("resource://torbutton/modules/default-prefs.js", {}); -ensureDefaultPrefs(); - // Import crypto object (FF 37+). Cu.importGlobalProperties(["crypto"]); diff --git a/components/dragDropFilter.js b/components/dragDropFilter.js index 9d6f74c8..f48d1b38 100644 --- a/components/dragDropFilter.js +++ b/components/dragDropFilter.js @@ -6,8 +6,6 @@ *************************************************************************/ -ChromeUtils.import("resource://torbutton/modules/default-prefs.js", {}).ensureDefaultPrefs(); - const { XPCOMUtils } = ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm"); const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm"); diff --git a/components/startup-observer.js b/components/startup-observer.js index 008134f8..d2d1d610 100644 --- a/components/startup-observer.js +++ b/components/startup-observer.js @@ -21,7 +21,6 @@ XPCOMUtils.defineLazyModuleGetters(this, { L10nRegistry: "resource://gre/modules/L10nRegistry.jsm", }); -ChromeUtils.import("resource://torbutton/modules/default-prefs.js", {}).ensureDefaultPrefs(); let NoScriptControl = ChromeUtils.import("resource://torbutton/modules/noscript-control.js", {}); // Module specific constants diff --git a/components/torbutton-logger.js b/components/torbutton-logger.js index 52fdfc23..1c946fa7 100644 --- a/components/torbutton-logger.js +++ b/components/torbutton-logger.js @@ -13,8 +13,6 @@ const kMODULE_NAME = "Torbutton Logger"; const kMODULE_CONTRACTID = "@torproject.org/torbutton-logger;1"; const kMODULE_CID = Components.ID("f36d72c9-9718-4134-b550-e109638331d7"); -ChromeUtils.import("resource://torbutton/modules/default-prefs.js", {}).ensureDefaultPrefs(); - const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm"); const { XPCOMUtils } = ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm"); diff --git a/defaults/preferences/preferences.js b/defaults/preferences/preferences.js deleted file mode 100644 index 100302b7..00000000 --- a/defaults/preferences/preferences.js +++ /dev/null @@ -1,55 +0,0 @@ -// debug prefs -pref("extensions.torbutton.loglevel",4); -pref("extensions.torbutton.logmethod",1); // 0=stdout, 1=errorconsole, 2=debuglog - -// Display prefs -pref("extensions.torbutton.display_circuit", true); -pref("extensions.torbutton(a)torproject.org.description", "chrome://torbutton/locale/torbutton.properties"); -pref("extensions.torbutton.updateNeeded", false); - -// Tor check and proxy prefs -pref("extensions.torbutton.test_enabled",true); -pref("extensions.torbutton.test_url","https://check.torproject.org/?TorButton=true"); -pref("extensions.torbutton.local_tor_check",true); -pref("extensions.torbutton.versioncheck_url","https://www.torproject.org/projects/torbrowser/RecommendedTBBVersions"); -pref("extensions.torbutton.versioncheck_enabled",true); -pref("extensions.torbutton.use_nontor_proxy",false); - -// State prefs: -pref("extensions.torbutton.startup",false); -pref("extensions.torbutton.inserted_button",false); -pref("extensions.torbutton.inserted_security_level",false); - -// TODO: This is just part of a stopgap until #14429 gets properly implemented. -// See #7255 for details. We display the warning three times to make sure the -// user did not click on it by accident. -pref("extensions.torbutton.maximize_warnings_remaining", 3); - -// Security prefs: -pref("extensions.torbutton.clear_http_auth",true); -pref("extensions.torbutton.close_newnym",true); -pref("extensions.torbutton.resize_new_windows",false); -pref("extensions.torbutton.startup_state", 2); // 0=non-tor, 1=tor, 2=last -pref("extensions.torbutton.tor_memory_jar",false); -pref("extensions.torbutton.nontor_memory_jar",false); -pref("extensions.torbutton.launch_warning",true); - -// Opt out of Firefox addon pings: -// https://developer.mozilla.org/en/Addons/Working_with_AMO -pref("extensions.torbutton(a)torproject.org.getAddons.cache.enabled", false); - -// Security Slider -pref("extensions.torbutton.security_slider", 4); -pref("extensions.torbutton.security_custom", false); - -pref("extensions.torbutton.confirm_plugins", true); -pref("extensions.torbutton.confirm_newnym", true); - -pref("extensions.torbutton.noscript_inited", false); -pref("extensions.torbutton.noscript_persist", false); - -// Browser home page: -pref("browser.startup.homepage", "chrome://torbutton/content/locale/non-localized.properties"); - -// This pref specifies an ad-hoc "version" for various pref update hacks we need to do -pref("extensions.torbutton.pref_fixup_version", 0); diff --git a/jar.mn b/jar.mn index 8b6cbcf7..2c6d186b 100644 --- a/jar.mn +++ b/jar.mn @@ -6,7 +6,6 @@ torbutton.jar: content/ (chrome/content/*) components/ (components/*) - defaults/ (defaults/*) modules/ (modules/*) skin/ (chrome/skin/*) diff --git a/modules/default-prefs.js b/modules/default-prefs.js deleted file mode 100644 index 5ea549f4..00000000 --- a/modules/default-prefs.js +++ /dev/null @@ -1,36 +0,0 @@ -let loaded = false; - -function ensureDefaultPrefs () { - if (loaded) { - return; - } - const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm"); - const kDefaultPreferences = "resource://torbutton/defaults/preferences/preferences.js"; - const defaultPrefBranch = Services.prefs.getDefaultBranch(null); - - const context = { - pref: function (aPrefName, aValue) { - const aValueType = typeof aValue; - if (aValueType === "boolean") { - defaultPrefBranch.setBoolPref(aPrefName, aValue); - } else if (aValueType === "number") { - defaultPrefBranch.setIntPref(aPrefName, aValue); - } else if (aValueType === "string") { - defaultPrefBranch.setCharPref(aPrefName, aValue); - } else { - Services.console.logStringMessage( - `Preference ${aPrefName} with value ${aValue} has an invalid value type`); - } - - // Disable the External App Blocker on Android - if ((aPrefName === "extensions.torbutton.launch_warning") && - (Services.appinfo.OS === "Android")) { - defaultPrefBranch.setBoolPref(aPrefName, false); - } - } - }; - Services.scriptloader.loadSubScript(kDefaultPreferences, context); - loaded = true; -} - -let EXPORTED_SYMBOLS = ["ensureDefaultPrefs"]; diff --git a/moz.build b/moz.build index 843cee0d..376c9976 100644 --- a/moz.build +++ b/moz.build @@ -4,6 +4,3 @@ # License, v. 2.0. If a copy of the MPL was not distributed with this # file, You can obtain one at http://mozilla.org/MPL/2.0/. JAR_MANIFESTS += ['jar.mn'] -JS_PREFERENCE_FILES += [ - 'defaults/preferences/preferences.js', -]

1 0

[torspec/master] control-spec: Add error codes to the commands.
by dgoulet＠torproject.org 19 Nov '19

19 Nov '19

commit 13928996f4928773605527b561cdb212c1d93766 Author: George Kadianakis <desnacked(a)riseup.net> Date: Tue May 7 18:15:09 2019 +0300 control-spec: Add error codes to the commands. --- control-spec.txt | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/control-spec.txt b/control-spec.txt index bc57639..21e104e 100644 --- a/control-spec.txt +++ b/control-spec.txt @@ -1826,6 +1826,11 @@ should be used for this client, and "Nickname" is an optional nickname for the client. + On success, "250 OK" is returned. Otherwise, the following error codes exist: + 251 - Client with with this "PrivateKeyBlob" already existed. + 512 - Syntax error in "HSAddress", or "PrivateKeyBlob" or "Nickname" + 551 - Client with with this "Nickname" already exists + 3.31. REMOVE_ONION_CLIENT_AUTH The syntax is: @@ -1835,6 +1840,10 @@ Tells the server to remove the client-side v3 client auth credentials for the onion service with "HSAddress" and client with key "PrivateKeyBlob". + On success "250 OK" is returned. Otherwise, the following error codes exist: + 512 - Syntax error in "HSAddress", or "PrivateKeyBlob". + 251 - Client with "PrivateKeyBlob" did not exist. + 3.32. VIEW_ONION_CLIENT_AUTH The syntax is: @@ -1857,6 +1866,9 @@ it's the filename of this client if the credentials are stored in the filesystem. + On success "250 OK" is returned. Otherwise, the following error codes exist: + 512 - Syntax error in "HSAddress". + 3.33. DROPOWNERSHIP The syntax is:

1 0

[torspec/master] fixup! control-spec: Various improvements following mailing list feedback.
by dgoulet＠torproject.org 19 Nov '19

19 Nov '19

commit dafda3944241e4ab6dfe0fee90d2e97979ac8f94 Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon Jun 3 16:18:21 2019 +0300 fixup! control-spec: Various improvements following mailing list feedback. --- control-spec.txt | 49 +++++++++++++++++++++++++++++++------------------ 1 file changed, 31 insertions(+), 18 deletions(-) diff --git a/control-spec.txt b/control-spec.txt index c2b8f1b..01063b0 100644 --- a/control-spec.txt +++ b/control-spec.txt @@ -1815,11 +1815,12 @@ The syntax is: "ONION_CLIENT_AUTH_ADD" SP HSAddress - SP "X25519PrivKey=" PrivateKeyBlob + SP KeyType ":" PrivateKeyBlob [SP "ClientName=" Nickname] - [SP "Type=" TYPE] CRLF + [SP "Flags=" TYPE] CRLF HSAddress = 56*Base32Character + KeyType = "x25519" is the only one supported right now PrivateKeyBlob = base64 encoding of x25519 key Tells the connected Tor to add client-side v3 client auth credentials for the @@ -1827,29 +1828,39 @@ key that should be used for this client, and "Nickname" is an optional nickname for the client. - TYPE is a comma-separated tuple of types for this new client. For now, the - currently supported types are: + FLAGS is a comma-separated tuple of flags for this new client. For now, the + currently supported flags are: "Permanent" - This client's credentials should be stored in the filesystem. If this is not set, the client's credentials are epheremal and stored in memory. + If client auth credentials already existed for this service, replace them + with the new ones. + + If Tor has cached onion service descriptors that it has been unable to + decrypt in the past (due to lack of client auth credentials), attempt to + decrypt those descriptors as soon as this command succeeds. + On success, "250 OK" is returned. Otherwise, the following error codes exist: - 251 - Client with with this "PrivateKeyBlob" already existed. + 251 - Client auth credentials for this onion service already existed and replaced. + 252 - Added client auth credentials and successfully decrypted a cached descriptor. 512 - Syntax error in "HSAddress", or "PrivateKeyBlob" or "Nickname" 551 - Client with with this "Nickname" already exists + 552 - Unrecognized KeyType 3.31. ONION_CLIENT_AUTH_REMOVE The syntax is: "ONION_CLIENT_AUTH_REMOVE" SP HSAddress - SP "X25519PrivKey=" PrivateKeyBlob CRLF + + KeyType = "x25519" is the only one supported right now Tells the connected Tor to remove the client-side v3 client auth credentials - for the onion service with "HSAddress" and client with key "PrivateKeyBlob". + for the onion service with "HSAddress". On success "250 OK" is returned. Otherwise, the following error codes exist: - 512 - Syntax error in "HSAddress", or "PrivateKeyBlob". - 251 - Client with "PrivateKeyBlob" did not exist. + 512 - Syntax error in "HSAddress". + 251 - Client credentials for "HSAddress" did not exist. 3.32. ONION_CLIENT_AUTH_VIEW @@ -1862,18 +1873,20 @@ The server reply format is: "250-ONION_CLIENT_AUTH_VIEW" [SP HSAddress] CRLF - *("250-CLIENT X25519PrivKey=" PrivateKeyBlob - [SP "ClientName=" Nickname] - [SP "Type=" TYPE] CRLF) + *("250-CLIENT" SP KeyType ":" PrivateKeyBlob + [SP "ClientName=" Nickname] + [SP "Flags=" FLAGS] CRLF) "250 OK" CRLF - Where "PrivateKeyBlob" is the x25519 private key of this client. "Nickname" - is an optional nickname for this client, which can be set either through the - ONION_CLIENT_AUTH_ADD command, or it's the filename of this client if the - credentials are stored in the filesystem. + KeyType = "x25519" is the only one supported right now + PrivateKeyBlob = base64 encoding of x25519 key + + "Nickname" is an optional nickname for this client, which can be set either + through the ONION_CLIENT_AUTH_ADD command, or it's the filename of this + client if the credentials are stored in the filesystem. - TYPE is a comma-separated field of types for this client, the currently - supported types are: + FLAGS is a comma-separated field of flags for this client, the currently + supported flags are: "Permanent" - This client's credentials are stored in the filesystem. On success "250 OK" is returned. Otherwise, the following error codes exist:

1 0

[torspec/master] control-spec: Specify add/remove/view client auth commands (client-side).
by dgoulet＠torproject.org 19 Nov '19

19 Nov '19

commit 3a26880e80617210b4729f96664ef9f0345b0b7c Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon May 6 18:13:57 2019 +0300 control-spec: Specify add/remove/view client auth commands (client-side). --- control-spec.txt | 48 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 47 insertions(+), 1 deletion(-) diff --git a/control-spec.txt b/control-spec.txt index eb3089b..bc57639 100644 --- a/control-spec.txt +++ b/control-spec.txt @@ -1811,7 +1811,53 @@ [HSPOST was added in Tor 0.2.7.1-alpha] -3.23. DROPOWNERSHIP +3.30. ADD_ONION_CLIENT_AUTH + + The syntax is: + "ADD_ONION_CLIENT_AUTH" SP HSAddress + SP "X25519Key=" PrivateKeyBlob + [SP "ClientName=" Nickname] CRLF + + HSAddress = 56*Base32Character + PrivateKeyBlob = base64 encoding of x25519 key + + Tells the server to add client-side v3 client auth credentials for the onion + service with "HSAddress". The "PrivateKeyBlob" is the x25519 private key that + should be used for this client, and "Nickname" is an optional nickname for + the client. + +3.31. REMOVE_ONION_CLIENT_AUTH + + The syntax is: + "REMOVE_ONION_CLIENT_AUTH" SP HSAddress + SP "X25519Key=" PrivateKeyBlob CRLF + + Tells the server to remove the client-side v3 client auth credentials for the + onion service with "HSAddress" and client with key "PrivateKeyBlob". + +3.32. VIEW_ONION_CLIENT_AUTH + + The syntax is: + "VIEW_ONION_CLIENT_AUTH" SP HSAddress CRLF + + Tells the server to list all the stored client-side v3 client auth + credentials for "HSAddress". + + The server reply format is: + "250-VIEW_ONION_CLIENT_AUTH" SP HSAddress CRLF + *("250-CLIENT X25519Key=" PrivateKeyBlob + [SP "ClientName=" Nickname] + [SP "Type=Permanent"] CRLF) + "250 OK" CRLF + + Where "PrivateKeyBlob" is the x25519 private key of this client. If the + client auth credentials are stored in the filesystem, "Type=Permanent" is + returned as part of the output. "Nickname" is an optional nickname for this + client, which can be set either through the ADD_ONION_CLIENT_AUTH command, or + it's the filename of this client if the credentials are stored in the + filesystem. + +3.33. DROPOWNERSHIP The syntax is: "DROPOWNERSHIP" CRLF

1 0

[torspec/master] control-spec: Various improvements following mailing list feedback.
by dgoulet＠torproject.org 19 Nov '19

19 Nov '19

commit ce38ad7e46da9840c7d211837c4bffb62d525ebf Author: George Kadianakis <desnacked(a)riseup.net> Date: Tue May 7 19:03:48 2019 +0300 control-spec: Various improvements following mailing list feedback. - Rename all commands to be less arbitrary - "Tells the server" -> "Tells the connected Tor" - Make TYPE an actual type thing. We only support one for now, but that's OK. Controllers and Tor can take shortcuts if needed. - Specify where credentials get stored. - Support viewing all the credentials. - Support the ADD command adding permanent credentials. - Change X25519Key to X25519PrivKey. --- control-spec.txt | 62 ++++++++++++++++++++++++++++++++------------------------ 1 file changed, 36 insertions(+), 26 deletions(-) diff --git a/control-spec.txt b/control-spec.txt index 21e104e..c2b8f1b 100644 --- a/control-spec.txt +++ b/control-spec.txt @@ -1811,60 +1811,70 @@ [HSPOST was added in Tor 0.2.7.1-alpha] -3.30. ADD_ONION_CLIENT_AUTH +3.30. ONION_CLIENT_AUTH_ADD The syntax is: - "ADD_ONION_CLIENT_AUTH" SP HSAddress - SP "X25519Key=" PrivateKeyBlob - [SP "ClientName=" Nickname] CRLF + "ONION_CLIENT_AUTH_ADD" SP HSAddress + SP "X25519PrivKey=" PrivateKeyBlob + [SP "ClientName=" Nickname] + [SP "Type=" TYPE] CRLF HSAddress = 56*Base32Character PrivateKeyBlob = base64 encoding of x25519 key - Tells the server to add client-side v3 client auth credentials for the onion - service with "HSAddress". The "PrivateKeyBlob" is the x25519 private key that - should be used for this client, and "Nickname" is an optional nickname for - the client. + Tells the connected Tor to add client-side v3 client auth credentials for the + onion service with "HSAddress". The "PrivateKeyBlob" is the x25519 private + key that should be used for this client, and "Nickname" is an optional + nickname for the client. + + TYPE is a comma-separated tuple of types for this new client. For now, the + currently supported types are: + "Permanent" - This client's credentials should be stored in the filesystem. + If this is not set, the client's credentials are epheremal + and stored in memory. On success, "250 OK" is returned. Otherwise, the following error codes exist: 251 - Client with with this "PrivateKeyBlob" already existed. 512 - Syntax error in "HSAddress", or "PrivateKeyBlob" or "Nickname" 551 - Client with with this "Nickname" already exists -3.31. REMOVE_ONION_CLIENT_AUTH +3.31. ONION_CLIENT_AUTH_REMOVE The syntax is: - "REMOVE_ONION_CLIENT_AUTH" SP HSAddress - SP "X25519Key=" PrivateKeyBlob CRLF + "ONION_CLIENT_AUTH_REMOVE" SP HSAddress + SP "X25519PrivKey=" PrivateKeyBlob CRLF - Tells the server to remove the client-side v3 client auth credentials for the - onion service with "HSAddress" and client with key "PrivateKeyBlob". + Tells the connected Tor to remove the client-side v3 client auth credentials + for the onion service with "HSAddress" and client with key "PrivateKeyBlob". On success "250 OK" is returned. Otherwise, the following error codes exist: 512 - Syntax error in "HSAddress", or "PrivateKeyBlob". 251 - Client with "PrivateKeyBlob" did not exist. -3.32. VIEW_ONION_CLIENT_AUTH +3.32. ONION_CLIENT_AUTH_VIEW The syntax is: - "VIEW_ONION_CLIENT_AUTH" SP HSAddress CRLF + "ONION_CLIENT_AUTH_VIEW" [SP HSAddress] CRLF - Tells the server to list all the stored client-side v3 client auth - credentials for "HSAddress". + Tells the connected Tor to list all the stored client-side v3 client auth + credentials for "HSAddress". If no "HSAddress" is provided, list all the + stored client-side v3 client auth credentials. The server reply format is: - "250-VIEW_ONION_CLIENT_AUTH" SP HSAddress CRLF - *("250-CLIENT X25519Key=" PrivateKeyBlob + "250-ONION_CLIENT_AUTH_VIEW" [SP HSAddress] CRLF + *("250-CLIENT X25519PrivKey=" PrivateKeyBlob [SP "ClientName=" Nickname] - [SP "Type=Permanent"] CRLF) + [SP "Type=" TYPE] CRLF) "250 OK" CRLF - Where "PrivateKeyBlob" is the x25519 private key of this client. If the - client auth credentials are stored in the filesystem, "Type=Permanent" is - returned as part of the output. "Nickname" is an optional nickname for this - client, which can be set either through the ADD_ONION_CLIENT_AUTH command, or - it's the filename of this client if the credentials are stored in the - filesystem. + Where "PrivateKeyBlob" is the x25519 private key of this client. "Nickname" + is an optional nickname for this client, which can be set either through the + ONION_CLIENT_AUTH_ADD command, or it's the filename of this client if the + credentials are stored in the filesystem. + + TYPE is a comma-separated field of types for this client, the currently + supported types are: + "Permanent" - This client's credentials are stored in the filesystem. On success "250 OK" is returned. Otherwise, the following error codes exist: 512 - Syntax error in "HSAddress".

1 0

[torspec/master] Merge branch 'tor-github/pr/81'
by dgoulet＠torproject.org 19 Nov '19

19 Nov '19

commit 03958da61f1502fd93f137c540f7697bc88a068f Merge: 5bd5f82 dafda39 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Nov 19 09:31:31 2019 -0500 Merge branch 'tor-github/pr/81' control-spec.txt | 83 +++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 82 insertions(+), 1 deletion(-)

1 0

[tor/master] control-port: Tests for ONION_CLIENT_AUTH_REMOVE.
by dgoulet＠torproject.org 19 Nov '19

19 Nov '19

commit ee4b2287c6426470db1f93043841bbc6bbcb2df9 Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon Jun 3 13:41:22 2019 +0300 control-port: Tests for ONION_CLIENT_AUTH_REMOVE. --- src/test/test_hs_control.c | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/src/test/test_hs_control.c b/src/test/test_hs_control.c index 497a43243..de2484ed3 100644 --- a/src/test/test_hs_control.c +++ b/src/test/test_hs_control.c @@ -193,6 +193,7 @@ test_hs_desc_event(void *arg) tor_free(expected_msg); } +/** DOCDOCDOC */ static void test_hs_control_good_onion_client_auth_add(void *arg) { @@ -271,10 +272,48 @@ test_hs_control_good_onion_client_auth_add(void *arg) tt_assert(!client_jt4->nickname); tt_int_op(client_jt4->flags, OP_EQ, 0); + /* Now try to remove the auth credentials */ + tor_free(conn.current_cmd); + conn.current_cmd = tor_strdup("ONION_CLIENT_AUTH_REMOVE"); + + /* First try with a wrong addr */ + tor_free(args); + args = tor_strdup("thatsok"); + + retval = handle_control_command(&conn, strlen(args), args); + tt_int_op(retval, OP_EQ, 0); + cp1 = buf_get_contents(TO_CONN(&conn)->outbuf, &sz); + tt_str_op(cp1, OP_EQ, "512 Invalid v3 address \"thatsok\"\r\n"); + + client_jt4 = digest256map_get(client_auths, service_identity_pk_jt4.pubkey); + tt_assert(client_jt4); + + /* Now actually remove them. */ + args =tor_strdup("jt4grrjwzyz3pjkylwfau5xnjaj23vxmhskqaeyfhrfylelw4hvxcuyd"); + + retval = handle_control_command(&conn, strlen(args), args); + tt_int_op(retval, OP_EQ, 0); + cp1 = buf_get_contents(TO_CONN(&conn)->outbuf, &sz); + tt_str_op(cp1, OP_EQ, "250 OK\r\n"); + + client_jt4 = digest256map_get(client_auths, service_identity_pk_jt4.pubkey); + tt_assert(!client_jt4); + + /* Now try another time (we should get 'already removed' msg) */ + retval = handle_control_command(&conn, strlen(args), args); + tt_int_op(retval, OP_EQ, 0); + cp1 = buf_get_contents(TO_CONN(&conn)->outbuf, &sz); + tt_str_op(cp1, OP_EQ, "251 No credentials for " + "\"jt4grrjwzyz3pjkylwfau5xnjaj23vxmhskqaeyfhrfylelw4hvxcuyd\"\r\n"); + + client_jt4 = digest256map_get(client_auths, service_identity_pk_jt4.pubkey); + tt_assert(!client_jt4); + done: tor_free(args); tor_free(cp1); buf_free(TO_CONN(&conn)->outbuf); + tor_free(conn.current_cmd); hs_client_free_all(); }

1 0