December 2020 - tor-commits - lists.torproject.org

[translation/fenix-torbrowserstringsxml_completed] https://gitweb.torproject.org/translation.git/commit/?h=fenix-torbrowserstringsxml_completed
by translation＠torproject.org 15 Dec '20

15 Dec '20

commit fc825d36dc25219efc388d32ea03729e6811965b Author: Translation commit bot <translation(a)torproject.org> Date: Tue Dec 15 07:45:30 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=fenix-torbrowserstr… --- hu/torbrowser_strings.xml | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/hu/torbrowser_strings.xml b/hu/torbrowser_strings.xml index 9abcf8617c..69ae15a432 100644 --- a/hu/torbrowser_strings.xml +++ b/hu/torbrowser_strings.xml @@ -2,6 +2,9 @@ - License, v. 2.0. If a copy of the MPL was not distributed with this - file, You can obtain one at http://mozilla.org/MPL/2.0/. --> <resources> +  + <string name="tor_about_content">%1$s - készíti: Tor Project, egy U.S.-bázisú 501(c)(3) nonprofit szervezet.</string> +  <string name="preferences_disable_normal_mode">Csak a privát böngészési mód engedélyezése</string>  @@ -20,6 +23,7 @@ <string name="tor_onboarding_security_level">Biztonsági szint beállítása</string> <string name="tor_onboarding_security_level_description">Néhány web szolgáltatás kikapcsolása, amivel támadhatják, sértve biztonságát és anonimitását.</string> + <string name="tor_onboarding_chosen_security_level_label">Jelenlegi Biztonsági Szint: %s</string> <string name="tor_onboarding_security_settings_button">Biztonsági beállítások megnyitása</string> <string name="tor_onboarding_donate_header">Támogasson a Tor biztonságáért</string> <string name="tor_onboarding_donate_description">A Tor ingyenes az Önhöz hasonló személyek támogatásai miatt.</string> @@ -54,4 +58,22 @@ <string name="preferences_tor_network_settings_restarting">Újraindítás</string> <string name="preferences_tor_network_settings_bridges_enabled">Hidak engedélyezve: %s</string> - </resources> +  + <string name="preferences_tor_security_level_settings">Biztonsági beállítások</string> + <string name="preferences_tor_security_level_options">Biztonsági szint</string> + +  + <string name="tor_security_level_standard_option">Normál</string> + <string name="tor_security_level_standard_description">Minden Tor Böngésző és weboldal szolgáltatás engedélyezve.</string> + <string name="tor_security_level_safer_option">Biztonságosabb</string> + <string name="tor_security_level_safer_description">Azon weboldal szolgáltatások tiltása, amelyek többnyire veszélyesek, ami néhány oldal működésének problémáit okozhatja.</string> + <string name="tor_security_level_safest_option">Legbiztonságosabb</string> + <string name="tor_security_level_safest_description">Csak azon weboldal szolgáltatások engedélyezése, amelyek a statikus, vagy alap szolgáltatásokhoz szükségesek. Ezek a beállítások érintik a képeket, médiákat és scripteket.</string> + +  + <string name="tor_spoof_english">Igényelje az angol verzióját a weboldalaknak a kibővített biztonságért</string> + + <string name="tor_useamask_usetor">Használjon maszkot, használjon Tor-t.</string> + <string name="tor_resistsurveillance">Álljon ellen a lehallgatási pandémiának.</string> + <string name="tor_donationmatch">A támogatásoddal egyező támogatás ad a Friends of Tor.</string> +</resources>

1 0

[translation/fenix-torbrowserstringsxml] https://gitweb.torproject.org/translation.git/commit/?h=fenix-torbrowserstringsxml
by translation＠torproject.org 15 Dec '20

15 Dec '20

commit e61e2ca896774c62985a83a1ad3f1ebffae3dce9 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Dec 15 07:45:25 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=fenix-torbrowserstr… --- hu/torbrowser_strings.xml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hu/torbrowser_strings.xml b/hu/torbrowser_strings.xml index 1dcab5b1ea..69ae15a432 100644 --- a/hu/torbrowser_strings.xml +++ b/hu/torbrowser_strings.xml @@ -70,6 +70,9 @@ <string name="tor_security_level_safest_option">Legbiztonságosabb</string> <string name="tor_security_level_safest_description">Csak azon weboldal szolgáltatások engedélyezése, amelyek a statikus, vagy alap szolgáltatásokhoz szükségesek. Ezek a beállítások érintik a képeket, médiákat és scripteket.</string> +  + <string name="tor_spoof_english">Igényelje az angol verzióját a weboldalaknak a kibővített biztonságért</string> + <string name="tor_useamask_usetor">Használjon maszkot, használjon Tor-t.</string> <string name="tor_resistsurveillance">Álljon ellen a lehallgatási pandémiának.</string> <string name="tor_donationmatch">A támogatásoddal egyező támogatás ad a Friends of Tor.</string>

1 0

[translation/fenix-torbrowserstringsxml_completed] https://gitweb.torproject.org/translation.git/commit/?h=fenix-torbrowserstringsxml_completed
by translation＠torproject.org 15 Dec '20

15 Dec '20

commit 129ebcddad4971e4946d35a474eeb4cf92f56156 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Dec 15 07:15:38 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=fenix-torbrowserstr… --- hu/torbrowser_strings.xml | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/hu/torbrowser_strings.xml b/hu/torbrowser_strings.xml index a1933791f8..9abcf8617c 100644 --- a/hu/torbrowser_strings.xml +++ b/hu/torbrowser_strings.xml @@ -20,12 +20,6 @@ <string name="tor_onboarding_security_level">Biztonsági szint beállítása</string> <string name="tor_onboarding_security_level_description">Néhány web szolgáltatás kikapcsolása, amivel támadhatják, sértve biztonságát és anonimitását.</string> - <string name="tor_onboarding_security_level_standard_option">Normál</string> - <string name="tor_onboarding_security_level_standard_button_description">Minden Tor Böngésző és weboldal szolgáltatás engedélyezve.</string> - <string name="tor_onboarding_security_level_safer_option">Biztonságosabb</string> - <string name="tor_onboarding_security_level_safer_button_description">Azon weboldal szolgáltatások tiltása, amelyek többnyire veszélyesek, ami néhány oldal működésének problémáit okozhatja.</string> - <string name="tor_onboarding_security_level_safest_option">Legbiztonságosabb</string> - <string name="tor_onboarding_security_level_safest_button_description">Csak azon weboldal szolgáltatások engedélyezése, amelyek a statikus, vagy alap szolgáltatásokhoz szükségesek. Ezek a beállítások érintik a képeket, médiákat és scripteket.</string> <string name="tor_onboarding_security_settings_button">Biztonsági beállítások megnyitása</string> <string name="tor_onboarding_donate_header">Támogasson a Tor biztonságáért</string> <string name="tor_onboarding_donate_description">A Tor ingyenes az Önhöz hasonló személyek támogatásai miatt.</string> @@ -59,4 +53,5 @@ <string name="preferences_tor_network_settings_connected">Csatlakozva</string> <string name="preferences_tor_network_settings_restarting">Újraindítás</string> <string name="preferences_tor_network_settings_bridges_enabled">Hidak engedélyezve: %s</string> -</resources> + + </resources>

1 0

[translation/fenix-torbrowserstringsxml] https://gitweb.torproject.org/translation.git/commit/?h=fenix-torbrowserstringsxml
by translation＠torproject.org 15 Dec '20

15 Dec '20

commit 3956f6f929e1838f88ab20cc6b0eb41927894750 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Dec 15 07:15:34 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=fenix-torbrowserstr… --- hu/torbrowser_strings.xml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/hu/torbrowser_strings.xml b/hu/torbrowser_strings.xml index 5c649b0349..1dcab5b1ea 100644 --- a/hu/torbrowser_strings.xml +++ b/hu/torbrowser_strings.xml @@ -2,6 +2,9 @@ - License, v. 2.0. If a copy of the MPL was not distributed with this - file, You can obtain one at http://mozilla.org/MPL/2.0/. --> <resources> +  + <string name="tor_about_content">%1$s - készíti: Tor Project, egy U.S.-bázisú 501(c)(3) nonprofit szervezet.</string> +  <string name="preferences_disable_normal_mode">Csak a privát böngészési mód engedélyezése</string>  @@ -69,4 +72,5 @@ <string name="tor_useamask_usetor">Használjon maszkot, használjon Tor-t.</string> <string name="tor_resistsurveillance">Álljon ellen a lehallgatási pandémiának.</string> - </resources> + <string name="tor_donationmatch">A támogatásoddal egyező támogatás ad a Friends of Tor.</string> +</resources>

1 0

[translation/abouttor-homepage_completed] https://gitweb.torproject.org/translation.git/commit/?h=abouttor-homepage_completed
by translation＠torproject.org 15 Dec '20

15 Dec '20

commit 3e7f006f7078a0a6608b19b3c94d384ddbdef7f3 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Dec 15 07:15:05 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=abouttor-homepage_c… --- hu/aboutTor.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hu/aboutTor.dtd b/hu/aboutTor.dtd index c9dcc75019..d910ddd047 100644 --- a/hu/aboutTor.dtd +++ b/hu/aboutTor.dtd @@ -33,4 +33,4 @@  <!ENTITY aboutTor.ey2020.useamask "Használjon maszkot, használjon Tor-t."> <!ENTITY aboutTor.ey2020.resistsurveillance "Álljon ellen a lehallgatási pandémiának."> -<!ENTITY aboutTor.ey2020.donationmatch ""> +<!ENTITY aboutTor.ey2020.donationmatch "A támogatásoddal egyező támogatás ad a Friends of Tor.">

1 0

[translation/abouttor-homepage] https://gitweb.torproject.org/translation.git/commit/?h=abouttor-homepage
by translation＠torproject.org 15 Dec '20

15 Dec '20

commit ce97ee0ccbb50fe1e9abb619439d1d6b81e84ea7 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Dec 15 07:15:02 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=abouttor-homepage --- hu/aboutTor.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hu/aboutTor.dtd b/hu/aboutTor.dtd index 5485636eba..d910ddd047 100644 --- a/hu/aboutTor.dtd +++ b/hu/aboutTor.dtd @@ -33,4 +33,4 @@  <!ENTITY aboutTor.ey2020.useamask "Használjon maszkot, használjon Tor-t."> <!ENTITY aboutTor.ey2020.resistsurveillance "Álljon ellen a lehallgatási pandémiának."> -<!ENTITY aboutTor.ey2020.donationmatch "Your donation will be matched by Friends of Tor."> +<!ENTITY aboutTor.ey2020.donationmatch "A támogatásoddal egyező támogatás ad a Friends of Tor.">

1 0

[collector/master] Include OnionPerf analysis files when syncing.
by karsten＠torproject.org 14 Dec '20

14 Dec '20

commit 06c0d78e4a73042c0e7fb6052f079237b8d7ff01 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Mon Dec 14 23:23:54 2020 +0100 Include OnionPerf analysis files when syncing. --- CHANGELOG.md | 4 +- .../collector/onionperf/OnionPerfDownloader.java | 1 + .../collector/persist/OnionPerfPersistence.java | 60 +++++++++++++++++++--- src/main/resources/collector.properties | 2 +- 4 files changed, 57 insertions(+), 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f56f74d..7956e55 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,8 +4,8 @@ - Clean up descriptors written to the `out/` directory by deleting files that are older than seven weeks. - Correctly index files that are moved away and back. - - Include microdescriptors and certs when syncing from another - CollecTor instance. + - Include microdescriptors, certs, and OnionPerf analysis files when + syncing from another CollecTor instance. - Update to metrics-lib 2.15.0. diff --git a/src/main/java/org/torproject/metrics/collector/onionperf/OnionPerfDownloader.java b/src/main/java/org/torproject/metrics/collector/onionperf/OnionPerfDownloader.java index f90bdfe..352d24a 100644 --- a/src/main/java/org/torproject/metrics/collector/onionperf/OnionPerfDownloader.java +++ b/src/main/java/org/torproject/metrics/collector/onionperf/OnionPerfDownloader.java @@ -57,6 +57,7 @@ public class OnionPerfDownloader extends CollecTorMain { public OnionPerfDownloader(Configuration config) { super(config); this.mapPathDescriptors.put("recent/torperf", TorperfResult.class); + this.mapPathDescriptors.put("recent/onionperf", TorperfResult.class); } /** File containing the download history, which is necessary, because diff --git a/src/main/java/org/torproject/metrics/collector/persist/OnionPerfPersistence.java b/src/main/java/org/torproject/metrics/collector/persist/OnionPerfPersistence.java index 7ed16a2..8975d80 100644 --- a/src/main/java/org/torproject/metrics/collector/persist/OnionPerfPersistence.java +++ b/src/main/java/org/torproject/metrics/collector/persist/OnionPerfPersistence.java @@ -6,12 +6,21 @@ package org.torproject.metrics.collector.persist; import org.torproject.descriptor.TorperfResult; import org.torproject.metrics.collector.conf.Annotation; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; import java.nio.file.Paths; import java.nio.file.StandardOpenOption; public class OnionPerfPersistence extends DescriptorPersistence<TorperfResult> { + private static final Logger logger + = LoggerFactory.getLogger(OnionPerfPersistence.class); + private static final String ONIONPERF = "torperf"; public OnionPerfPersistence(TorperfResult desc) { @@ -32,18 +41,55 @@ public class OnionPerfPersistence name).toString(); } - /** OnionPerf default storage appends. */ + /** If the original descriptor file was a .tpf file, append the parsed Torperf + * result to the destination .tpf file, but if it was a .json.xz file, just + * copy over the entire file, unless it already exists. */ @Override - public boolean storeOut(String outRoot) { - return super.storeOut(outRoot, StandardOpenOption.APPEND); + public boolean storeOut(String outRoot, StandardOpenOption option) { + if (desc.getDescriptorFile().getName().endsWith(".tpf")) { + return super.storeOut(outRoot, StandardOpenOption.APPEND); + } else { + String fileName = desc.getDescriptorFile().getName(); + String[] dateParts = fileName.split("\\.")[0].split("-"); + return this.copyIfNotExists( + Paths.get(outRoot, + "onionperf", + dateParts[0], // year + dateParts[1], // month + dateParts[2], // day + fileName)); + } } - /** OnionPerf default storage appends. */ + /** If the original descriptor file was a .tpf file, append the parsed Torperf + * result to the destination .tpf file, but if it was a .json.xz file, just + * copy over the entire file, unless it already exists. */ @Override - public boolean storeAll(String recentRoot, String outRoot) { - return super.storeAll(recentRoot, outRoot, StandardOpenOption.APPEND, - StandardOpenOption.APPEND); + public boolean storeRecent(String recentRoot, StandardOpenOption option) { + if (desc.getDescriptorFile().getName().endsWith(".tpf")) { + return super.storeRecent(recentRoot, StandardOpenOption.APPEND); + } else { + String fileName = desc.getDescriptorFile().getName(); + return this.copyIfNotExists( + Paths.get(recentRoot, + "onionperf", + fileName)); + } } + private boolean copyIfNotExists(Path destinationFile) { + if (Files.exists(destinationFile)) { + return false; + } + Path originalFile = this.desc.getDescriptorFile().toPath(); + try { + Files.createDirectories(destinationFile.getParent()); + Files.copy(originalFile, destinationFile); + } catch (IOException e) { + logger.warn("Unable to copy file.", e); + return false; + } + return true; + } } diff --git a/src/main/resources/collector.properties b/src/main/resources/collector.properties index 2347021..99a7cfa 100644 --- a/src/main/resources/collector.properties +++ b/src/main/resources/collector.properties @@ -175,7 +175,7 @@ ExitlistUrl = https://check.torproject.org/exit-addresses ######## OnionPerf downloader ######## # ## Define descriptor sources -# possible values: Remote,Sync (.tpf files only!) +# possible values: Remote, Sync OnionPerfSources = Remote # Retrieve files from the following CollecTor instances. # List of URLs separated by comma.

1 0

[community/master] Add gaba's review, explicitly say SecureDrop onion service
by gus＠torproject.org 14 Dec '20

14 Dec '20

commit 21b58560186f095aab029f02fd087785599f1cb8 Author: gus <gus(a)torproject.org> Date: Mon Dec 14 12:47:43 2020 -0500 Add gaba's review, explicitly say SecureDrop onion service --- content/onion-services/overview/contents.lr | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/onion-services/overview/contents.lr b/content/onion-services/overview/contents.lr index 1fa3c20..8d6be84 100644 --- a/content/onion-services/overview/contents.lr +++ b/content/onion-services/overview/contents.lr @@ -93,7 +93,7 @@ All the previous steps were just set up for the onion service so that it's reach Now let's fast-forward to the point where an actual client wants to visit the service. In this case, the client has the onion address of SecureDrop and want to visit it, so they connect to the service with Tor Browser. -Now the next thing that needs to happen is that the client goes to the _distributed hash table_ from **Step 2** and ask for the signed descriptor of SecureDrop. +Now the next thing that needs to happen is that the client goes to the _distributed hash table_ from **Step 2** and ask for the signed descriptor of SecureDrop's onion service. <img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-04.png" alt="Onion Services: Step 4"> @@ -102,7 +102,7 @@ Now the next thing that needs to happen is that the client goes to the _distribu When the client receives the signed descriptor, they verify the signature of the descriptor using the public key that is encoded in the onion address. This provides the _end-to-end authentication_ security property, since we are now sure that this descriptor could only be produced by that onion service and no one else. -And inside the descriptor, there are the introduction points that allow the client to introduce themselves to SecureDrop. +And inside the descriptor, there are the introduction points that allow the client to introduce themselves to SecureDrop's onion service. <img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-05.png" alt="Onion Services: Step 5"> @@ -115,7 +115,7 @@ The client asks the relay to become their rendezvous point and give it an "one-t ### Act 7: Where the onion service rendezvous with the client -The introduction point passes your details on to the onion service, which runs multiple verification processes to decide whether you're trustworthy or not. +The introduction point passes your details (secret string and rendezvous address) on to the onion service, which runs multiple verification processes to decide whether you're trustworthy or not. <img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-07.png" alt="Onion Services: Step 7">

1 0

[community/master] Add new onion services images. Fix #152
by gus＠torproject.org 14 Dec '20

14 Dec '20

commit 80623c484a325f45036e2f6ded98988336434730 Author: gus <gus(a)torproject.org> Date: Wed Dec 9 21:58:26 2020 -0500 Add new onion services images. Fix #152 --- .../onion-services/overview/onion-service-01.png | Bin 0 -> 152528 bytes .../onion-services/overview/onion-service-02.png | Bin 0 -> 119489 bytes .../onion-services/overview/onion-service-03.png | Bin 0 -> 141765 bytes .../onion-services/overview/onion-service-04.png | Bin 0 -> 159940 bytes .../onion-services/overview/onion-service-05.png | Bin 0 -> 172457 bytes .../onion-services/overview/onion-service-06.png | Bin 0 -> 147472 bytes .../onion-services/overview/onion-service-07.png | Bin 0 -> 137636 bytes .../onion-services/overview/onion-service-08.png | Bin 0 -> 137909 bytes .../onion-services/overview/onion-service-09.png | Bin 0 -> 125387 bytes .../overview/tor-onion-services-1.png | Bin 17222 -> 0 bytes .../overview/tor-onion-services-4.png | Bin 21419 -> 0 bytes content/onion-services/overview/contents.lr | 101 ++++++++++++--------- 12 files changed, 57 insertions(+), 44 deletions(-) diff --git a/assets/static/images/onion-services/overview/onion-service-01.png b/assets/static/images/onion-services/overview/onion-service-01.png new file mode 100755 index 0000000..cd92201 Binary files /dev/null and b/assets/static/images/onion-services/overview/onion-service-01.png differ diff --git a/assets/static/images/onion-services/overview/onion-service-02.png b/assets/static/images/onion-services/overview/onion-service-02.png new file mode 100755 index 0000000..d50c0ad Binary files /dev/null and b/assets/static/images/onion-services/overview/onion-service-02.png differ diff --git a/assets/static/images/onion-services/overview/onion-service-03.png b/assets/static/images/onion-services/overview/onion-service-03.png new file mode 100755 index 0000000..e551d9c Binary files /dev/null and b/assets/static/images/onion-services/overview/onion-service-03.png differ diff --git a/assets/static/images/onion-services/overview/onion-service-04.png b/assets/static/images/onion-services/overview/onion-service-04.png new file mode 100755 index 0000000..7f68c8a Binary files /dev/null and b/assets/static/images/onion-services/overview/onion-service-04.png differ diff --git a/assets/static/images/onion-services/overview/onion-service-05.png b/assets/static/images/onion-services/overview/onion-service-05.png new file mode 100755 index 0000000..5e8ba7a Binary files /dev/null and b/assets/static/images/onion-services/overview/onion-service-05.png differ diff --git a/assets/static/images/onion-services/overview/onion-service-06.png b/assets/static/images/onion-services/overview/onion-service-06.png new file mode 100755 index 0000000..cb59f60 Binary files /dev/null and b/assets/static/images/onion-services/overview/onion-service-06.png differ diff --git a/assets/static/images/onion-services/overview/onion-service-07.png b/assets/static/images/onion-services/overview/onion-service-07.png new file mode 100755 index 0000000..ad20f47 Binary files /dev/null and b/assets/static/images/onion-services/overview/onion-service-07.png differ diff --git a/assets/static/images/onion-services/overview/onion-service-08.png b/assets/static/images/onion-services/overview/onion-service-08.png new file mode 100755 index 0000000..34d4ba7 Binary files /dev/null and b/assets/static/images/onion-services/overview/onion-service-08.png differ diff --git a/assets/static/images/onion-services/overview/onion-service-09.png b/assets/static/images/onion-services/overview/onion-service-09.png new file mode 100755 index 0000000..062a158 Binary files /dev/null and b/assets/static/images/onion-services/overview/onion-service-09.png differ diff --git a/assets/static/images/onion-services/overview/tor-onion-services-1.png b/assets/static/images/onion-services/overview/tor-onion-services-1.png deleted file mode 100644 index 75de366..0000000 Binary files a/assets/static/images/onion-services/overview/tor-onion-services-1.png and /dev/null differ diff --git a/assets/static/images/onion-services/overview/tor-onion-services-4.png b/assets/static/images/onion-services/overview/tor-onion-services-4.png deleted file mode 100644 index 88db970..0000000 Binary files a/assets/static/images/onion-services/overview/tor-onion-services-4.png and /dev/null differ diff --git a/content/onion-services/overview/contents.lr b/content/onion-services/overview/contents.lr index 1122aa1..1fa3c20 100644 --- a/content/onion-services/overview/contents.lr +++ b/content/onion-services/overview/contents.lr @@ -45,7 +45,6 @@ Is your network filtered and you can't open ports on your firewall? This could happen if you are in a university campus, an office, an airport, or pretty much anywhere. Onion services don't need open ports because they punch through NAT. They only establish outgoing connections. - ## The Onion Service Protocol: Overview Now the question becomes **what kind of protocol is needed to achieve all these properties?** @@ -56,79 +55,93 @@ In particular, an onion service's address looks like this: `vww6ybal4bd7szmgncyr This looks weird and random because it's the _identity public key_ of the onion service. That's one of the reasons we can achieve the security properties above. -The onion service protocol uses the Tor network so that the client (Alice) can introduce itself to the service (Bob), and then set up a rendezvous point with the service over the Tor network. +The onion service protocol uses the Tor network so that the client can introduce itself to the service, and then set up a rendezvous point with the service over the Tor network. Here is a detailed breakdown of how this happens: ### Act 1: Where the onion service sets up its introduction points -![Onion Services: Step 1](/static/images/onion-services/overview/tor-onion-services-1.png) +Let's imagine that your local newspaper decides to set up an onion service (using [SecureDrop](https://securedrop.org/)) to receive anonymous tips. +As the first step in the protocol, the onion service will contact a bunch of Tor relays and ask them to act as its _introduction points_ by establishing long-term circuits to them. +These circuits are anonymized circuits, so the server does not reveal the service location to the introduction points. -As the first step in the protocol, Bob (the onion service) contacts a bunch of Tor relays and asks them to act as his _introduction points_, by establishing long-term circuits to them. -These circuits are anonymized circuits, so Bob does not reveal his locations to his introduction points. +The onion service will hide and protect itself behind the Tor network by only allowing access through three introduction points that it connects to through a three-hop Tor circuit. -As part of this step, Bob gives its introduction point a special "authentication key", so that if any clients come for introductions later the introduction point can use that key to match them to Bob. +<img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-01.png" alt="Onion Services: Step 1"> ### Act 2: Where the onion service publishes its descriptors -![Onion Services: Step 2](/static/images/onion-services/overview/tor-onion-services-2.png) - -Now that the introduction points are setup, we need to create a way for clients to be able to find them. +Now that the introduction points are set up, we need to create a way for clients to be able to find them. -For this reason, Bob assembles an _onion service descriptor_, containing a list of his introduction points (and their "authentication keys"), and signs this descriptor with his _identity private key_. +For this reason, the onion service assembles an _onion service descriptor_, containing a list of its introduction points (and "authentication keys"), and signs this descriptor with the onion service's _identity private key_. The _identity private key_ used here is the private part of the **public key that is encoded in the onion service address**. -Now, Bob uploads that signed descriptor to a _distributed hash table_ which is part of the Tor network, so that clients can also get it. -Bob uses an anonymized Tor circuit to do this upload, so that he does not reveal his location. +The onion service upload that signed descriptor to a _distributed hash table_, which is part of the Tor network, so that clients can also get it. +It uses an anonymized Tor circuit to do this upload so that it does not reveal its location. -### Act 3: Where a client wants to visit the onion service +<img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-02.png" alt="Onion Services: Step 2"> -All the previous steps were just setup for the onion service so that it's reachable by clients. -Now let's fast-forward to the point where an actual client wants to visit the service: +### Act 3: Where a client wants to visit the onion service -![Onion Services: Step 3](/static/images/onion-services/overview/tor-onion-services-3.png) +Say you want to anonymously send some tax fraud data to your local newspaper through its SecureDrop. +You find the onion address for the newspaper's SecureDrop from a public website or friend. -In this case, Alice (the client) has the onion address of Bob and she wants to visit it, so she connects to it with her Tor Browser. -Now the next thing that needs to happen is that Alice goes to the _distributed hash table_ from the step above, and ask for the signed descriptor of Bob. +<img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-03.png" alt="Onion Services: Step 3"> -When Alice receives the signed descriptor, she verifies the signature of the descriptor using the public key that is encoded in the onion address. -This provides the _end-to-end authentication_ security property, since we are now sure that this descriptor could only be produced by Bob and no one else. -And inside the descriptor there are the introduction points which allow Alice to introduce herself to Bob. +### Act 4: Where the client introduces itself to the onion service -### Act 4: Where the client establishes a rendezvous point +All the previous steps were just set up for the onion service so that it's reachable by clients. +Now let's fast-forward to the point where an actual client wants to visit the service. -Now before the introduction takes place, Alice picks a Tor relay and establishes a circuit to it. -Alice asks the relay to become her _rendezvous point_ and gives it an "one-time secret" that will be used as part of the rendezvous procedure. +In this case, the client has the onion address of SecureDrop and want to visit it, so they connect to the service with Tor Browser. +Now the next thing that needs to happen is that the client goes to the _distributed hash table_ from **Step 2** and ask for the signed descriptor of SecureDrop. -### Act 5: Where the client introduces itself to the onion service +<img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-04.png" alt="Onion Services: Step 4"> -![Onion Services: Step 4](/static/images/onion-services/overview/tor-onion-services-4.png) +### Act 5: Where the client verify onion address signature -Now, Alice goes ahead and connects to one of Bob's introduction points and introduces herself to Bob. -Through this introduction Bob learns Alice's choice of rendezvous point and the "one-time secret". +When the client receives the signed descriptor, they verify the signature of the descriptor using the public key that is encoded in the onion address. +This provides the _end-to-end authentication_ security property, since we are now sure that this descriptor could only be produced by that onion service and no one else. -### Act 6: Where the onion service rendezvous with the client +And inside the descriptor, there are the introduction points that allow the client to introduce themselves to SecureDrop. -![Onion Services: Step 5](/static/images/onion-services/overview/tor-onion-services-5.png) +<img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-05.png" alt="Onion Services: Step 5"> -In this last act, the onion service is now aware of Alice's rendezvous point. -The onion service connects to the rendezvous point (through an anonymized circuit) and sends the "one-time secret" to it. +### Act 6: Where the client establishes a rendezvous point + +Before the introduction takes place, the client (in this case, you) picks a Tor relay and establishes a circuit to it. +The client asks the relay to become their rendezvous point and give it an "one-time secret" that will be used as part of the rendezvous procedure. + +<img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-06.png" alt="Onion Services: Step 6"> + +### Act 7: Where the onion service rendezvous with the client + +The introduction point passes your details on to the onion service, which runs multiple verification processes to decide whether you're trustworthy or not. -Upon the rendezvous point receiving the "one-time secret" from Bob, it informs Alice that the connection has been **successfuly completed**, and now Alice and Bob can use this circuit to communicate with each other. +<img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-07.png" alt="Onion Services: Step 7"> + +### Act 8: Where the rendezvous point verifies the client's secret + +The onion service connects to the rendezvous point (through an anonymized circuit) and sends the "one-time secret" to it. The rendezvous point simply relays (end-to-end encrypted) messages from client to service and vice versa. -In general, the complete connection between client and onion service consists of 6 relays: 3 of them were picked by the client with the third being the rendezvous point and the other 3 were picked by the onion service. -This provides _location hiding_ to this connection: +The rendezvous point makes one final verification to match the secret strings from you and service (the latter also comes from you but has been relayed through the service). + +<img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-08.png" alt="Onion Services: Step 8"> + +### Act 9: Where the onion service rendezvous with the client + +In general, the complete connection between client and onion service consists of 6 relays: 3 of them were picked by the client, with the third being the rendezvous point, and the other 3 were picked by the onion service. +This provides _location hiding_ to this connection. + +Finally, using the rendezvous point, a Tor circuit is formed between you and your newspaper's SecureDrop onion service. -![Onion Services: Step 6](/static/images/onion-services/overview/tor-onion-services-6.png) +<img class="col-lg-8" src="../../static/images/onion-services/overview/onion-service-09.png" alt="Onion Services: Step 9"> ## Further resources -This was just a high-level overview of the Tor onion services protocol. Here are some more resources if you want to learn more: +This was just a high-level overview of the Tor onion services protocol. +Here are some more resources if you want to learn more: -- The original Tor design paper describing the original design: -https://svn.torproject.org/svn/projects/design-paper/tor-design.pdf -- The Tor v3 onion services protocol specification. -https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.txt -- Presentations about onion services -https://www.youtube.com/watch?v=VmsFxBEN3fc -https://www.youtube.com/watch?v=Di7qAVidy1Y +- The [Tor design paper](https://svn.torproject.org/svn/projects/design-paper/tor-design.pdf) describing the original design. +- The [Tor v3 onion services](https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.txt) protocol specification. +- Presentations about onion services: [Understanding Tor Onion Services and Their Use Cases - HOPE XI 2016](https://www.youtube.com/watch?v=VmsFxBEN3fc), [DEF CON 25 - Roger Dingledine - Next Generation Tor Onion Services](https://www.youtube.com/watch?v=Di7qAVidy1Y).

1 0

[community/master] Merge branch 'update-onion-services-images'
by gus＠torproject.org 14 Dec '20

14 Dec '20

commit 66a2b6656053cd72cc3571d7abc8ebf127b964db Merge: 7ad8087 21b5856 Author: gus <gus(a)torproject.org> Date: Mon Dec 14 17:13:42 2020 -0500 Merge branch 'update-onion-services-images' .../onion-services/overview/onion-service-01.png | Bin 0 -> 152528 bytes .../onion-services/overview/onion-service-02.png | Bin 0 -> 119489 bytes .../onion-services/overview/onion-service-03.png | Bin 0 -> 141765 bytes .../onion-services/overview/onion-service-04.png | Bin 0 -> 159940 bytes .../onion-services/overview/onion-service-05.png | Bin 0 -> 172457 bytes .../onion-services/overview/onion-service-06.png | Bin 0 -> 147472 bytes .../onion-services/overview/onion-service-07.png | Bin 0 -> 137636 bytes .../onion-services/overview/onion-service-08.png | Bin 0 -> 137909 bytes .../onion-services/overview/onion-service-09.png | Bin 0 -> 125387 bytes .../overview/tor-onion-services-1.png | Bin 17222 -> 0 bytes .../overview/tor-onion-services-4.png | Bin 21419 -> 0 bytes content/onion-services/overview/contents.lr | 101 ++++++++++++--------- 12 files changed, 57 insertions(+), 44 deletions(-)

1 0