tor-hs: use named sections #21642

stokito · 2023-07-23T19:21:25Z

Maintainer: @ja-pa
Compile tested: no
Run tested: TurrisOS 6.3.3

Description: minor changes to improve usability, see commit messages.

stokito · 2023-07-23T20:10:13Z

I also wanted to discuss how the tor config can be simplified. Here are current default configs:

config tor 'conf'
	option default '/etc/tor/torrc'
	option generated '/tmp/torrc'
	list tail_include '/etc/tor/torrc_generated'

The /tmp/torrc looks like

## This file was automatically generated please do not edit here !
%include /etc/tor/torrc
%include /etc/tor/torrc_generated

And the /etc/config/tor-hs

config tor-hs common
	option GenConf "/etc/tor/torrc_generated"

It looks for me like too many of moving parts. Why would I need to edit the tor.conf.default option?
Essentially this all can be replaced with a few includes directly in the torrc file. By default it already has a line
%include /etc/torrc.d/*.conf but it's commented out.
Maybe just add a patch to uncomment the line directly in the torrc and this will simplify a lot of things and many options and creation of a temp file won't be needed.

I created a topic Default folder for onion services where proposed to the Tor team to do that on their side. Also to create a standard location for hidden services.

The tor-hs itself has a problem that the generated file is stored to /etc/tor/torrc_generated which may kill NAND flash eventually. Instead we may generate the file into /var/run/tor older which is an in-memory temp folder.
The generation itself may be skipped if last modify time of uci config file is before the creted time of the /etc/tor/torrc_generated. The simple optimization but may safe some time on restart.

Signed-off-by: Sergey Ponomarev <[email protected]>

Using substring instead of awk. It changes behaviour when only one port is specified. Previously: value="80" => public="80" local="" Now: value="80" => public="80" local="80" It simplifies configuration of one-to-one ports. Signed-off-by: Sergey Ponomarev <[email protected]>

BKPepe · 2023-07-24T11:20:44Z

I am not sure if @ja-pa continues using his Turris router together with tor, but to be safe about this. Let's also ping guys from @turris-cz, especially packagers (@paper42 , @miska), to look into it further because they could be interested in it. They do have Tor listed in reForis under package management:

stokito · 2023-07-24T12:51:47Z

I tested on my Turris but I installed the tor from opkg. Now I enabled the Tor in packages but looks like nothing changed. How to check what exactly was installed?

Currently the tor package itself doesn't have any UCI options. From what I understand the tor by default creates a socks proxy on localhost:9050 but this can be changed to SOCKSPort 192.168.1.1:9050 so that anyone from a local network can use it. I created a proxy PAC file so that all .onion domains are resolved with the local tor. Maybe add the SOCKSPort as UCI option?
Basically other settings are for bridge or exit node and looks like not needed.

stokito · 2023-08-04T00:47:39Z

Also it may be better to introduce a new option Target or Destination instead of the Ipv4 because it can be also IPv6 or even a domain. The IPv4 name is highly confusing.

Signed-off-by: Sergey Ponomarev <[email protected]>

The Name is used as a HS folder name and can't be empty. Signed-off-by: Sergey Ponomarev <[email protected]>

Replace boolean "true"/"false" with more frequently used 1/0. This may avoid configuration mistakes which is critical for Tor. The Luci app anyway will set it as 1/0. Make sections named. This is not required but again safes from mistakes when executing uci command. Uncomment sections but disable them by default. Then in a Luci app a user can quickly figure out what to change. Ideally a user may just enable the config and start using it. In the nextcloud config use a single 80 instead of 80;80. This simpler configuration is now supported. Instead of "Hidden service" the Tor team now uses "Onion service". Signed-off-by: Sergey Ponomarev <[email protected]>

stokito · 2023-08-04T14:21:08Z

I added 83e19fb to prevent error when Name is empty

BKPepe · 2023-08-18T13:57:43Z

Let's ping anyone from @turris-cz to look into it.

stokito · 2023-08-18T17:49:26Z

the changes are really minimal and can be reviewed just by eyes. The only questionable change is 83e19fb where onion services without a required Name are skipped.
I think it would be better to add a uci validation instead. But if the validation failed then as far I remember the whole service won't start. This may broke existing configuration if just one hidden service is broken.
Honestly I don't want to waste time on this because anyway this highly unlikely to happen. If a user will use a luci-app-tor then the Name will be always set anyway.

stokito · 2024-02-04T08:14:34Z

@ja-pa @BKPepe please merge

BKPepe · 2024-02-04T08:15:44Z

No one reviewed it yet and it seems like Turris guys are not interested in this anymore. I am not going to merge this unless I will or anyone else will review this.

Remove unused description. Quote variables. Use hostname_file variable. Remove unnecessary quotes around "common". Use echo -n to truncate a TORRC_FILE. Signed-off-by: Sergey Ponomarev <[email protected]>

Signed-off-by: Sergey Ponomarev <[email protected]>

stokito · 2024-02-06T22:18:18Z

I made additional cleanup and added validation.

Signed-off-by: Sergey Ponomarev <[email protected]>

Previously the chown/chmod was performed each time even if the folder already existed. Signed-off-by: Sergey Ponomarev <[email protected]>

On each tor-hs service restart it generates a config file /etc/tor/torrc_generated. The /etc/ is stored on a disk and kills it and slow. Instead create a dedicated tor service Runtime Dir in the temp /var/run/. It will be accessible only to the tor user. Signed-off-by: Sergey Ponomarev <[email protected]>

Mark the /etc/tor folder to keep during sysupgrade. The folder contains hidden_services folder with keys. Signed-off-by: Sergey Ponomarev <[email protected]>

Add me as a second maintainer. Remove outdated README.md but put a link to a Wiki instead. Use Onion Service instead of Hidden Service. Signed-off-by: Sergey Ponomarev <[email protected]>

stangri · 2024-02-08T15:25:49Z

LGTM. Not sure if it's still required to squash commits, otherwise GTG.

BKPepe · 2024-02-08T15:37:40Z

Because Jan seems no longer be involved in package, which he created and added, feel free to retake maintainership. Dne čt 8. 2. 2024 16:26 uživatel Stan Grishin ***@***.***> napsal:

…

LGTM. Not sure if it's still required to squash commits, otherwise GTG. — Reply to this email directly, view it on GitHub <#21642 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA7IDVAUZWXCYSSQUDFVOOLYSTVATAVCNFSM6AAAAAA2UWIPBKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSMZUGM3DKMZUGY> . You are receiving this because you were mentioned.Message ID: ***@***.***>

stokito · 2024-02-08T15:39:24Z

In the 21bd809 I added myself as a second maintainer

PKG_MAINTAINER:=Jan Pavlinec [email protected], Sergey Ponomarev [email protected]

BKPepe · 2024-02-08T15:41:10Z

I know, but maybe we misunderstood each other. :) You dont need to be 2nd maintainer as you seems to be using this package. So take maintainership Dne čt 8. 2. 2024 16:39 uživatel Sergey Ponomarev ***@***.***> napsal:

…

In the 21bd809 <21bd809> I added myself as a second maintainer PKG_MAINTAINER:=Jan Pavlinec ***@***.***, Sergey Ponomarev ***@***.*** — Reply to this email directly, view it on GitHub <#21642 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA7IDVEI26M4UKO53XJJKZLYSTWTRAVCNFSM6AAAAAA2UWIPBKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSMZUGM4TGNBUGQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

stokito · 2024-02-08T15:43:53Z

I don't see any problem to have two maintainers

stokito changed the title ~~Tor hs~~ tor-hs minor changes Jul 23, 2023

stokito mentioned this pull request Jul 23, 2023

luci-app-tor: Manage tor-hs onion services openwrt/luci#6476

Merged

stokito added 2 commits July 23, 2023 23:33

tor-hs: tor-hs.init handle_hs_ports_conf: remove unused name var

c6bd729

Signed-off-by: Sergey Ponomarev <[email protected]>

stokito force-pushed the tor-hs branch from 44cb70b to 3219f50 Compare July 23, 2023 20:35

BKPepe requested a review from ja-pa July 24, 2023 11:16

stokito added 3 commits August 4, 2023 17:20

tor-hs: tor-hs.init remove unused clean_hs()

3f1f373

Signed-off-by: Sergey Ponomarev <[email protected]>

tor-hs: tor-hs.init skip onion service when Name empty

83e19fb

The Name is used as a HS folder name and can't be empty. Signed-off-by: Sergey Ponomarev <[email protected]>

stokito force-pushed the tor-hs branch from 3219f50 to 88f54fe Compare August 4, 2023 14:20

stokito force-pushed the tor-hs branch 2 times, most recently from 01472f3 to 3a243fd Compare February 5, 2024 07:41

stokito changed the title ~~tor-hs minor changes~~ tor-hs: use named sections Feb 5, 2024

stokito added 2 commits February 7, 2024 00:16

tor-hs: reformat and cleanup

b19f84d

Remove unused description. Quote variables. Use hostname_file variable. Remove unnecessary quotes around "common". Use echo -n to truncate a TORRC_FILE. Signed-off-by: Sergey Ponomarev <[email protected]>

tor-hs: Use config_get_bool for enable_hs

4715419

Signed-off-by: Sergey Ponomarev <[email protected]>

stokito force-pushed the tor-hs branch from 3a243fd to e24eff6 Compare February 6, 2024 22:17

stokito added 2 commits February 7, 2024 21:00

tor-hs: add validation

4301994

Signed-off-by: Sergey Ponomarev <[email protected]>

tor-hs: create hs folder only if not exists

b1370b7

Previously the chown/chmod was performed each time even if the folder already existed. Signed-off-by: Sergey Ponomarev <[email protected]>

stokito force-pushed the tor-hs branch from e24eff6 to b574c1d Compare February 7, 2024 19:01

stokito added 2 commits February 8, 2024 00:16

tor-hs: keep /etc/tor config folder

15971ae

Mark the /etc/tor folder to keep during sysupgrade. The folder contains hidden_services folder with keys. Signed-off-by: Sergey Ponomarev <[email protected]>

tor-hs: bump version to 0.1.0

21bd809

Add me as a second maintainer. Remove outdated README.md but put a link to a Wiki instead. Use Onion Service instead of Hidden Service. Signed-off-by: Sergey Ponomarev <[email protected]>

stokito force-pushed the tor-hs branch from b574c1d to 21bd809 Compare February 7, 2024 22:30

stokito mentioned this pull request Feb 25, 2024

tor: add /etc/torrc.d/ to conffiles #23536

Open

stokito mentioned this pull request May 18, 2024

Use UCI config_get_bool enabled instead of config_get enabled #24187

Merged

stokito mentioned this pull request Oct 17, 2024

tor-hs: refactor + readme fixes #25162

Open

codekow mentioned this pull request Jan 2, 2025

tor-hs: init script does not handle boolean correctly #25640

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

tor-hs: use named sections #21642

tor-hs: use named sections #21642

stokito commented Jul 23, 2023

stokito commented Jul 23, 2023 •

edited

Loading

BKPepe commented Jul 24, 2023

stokito commented Jul 24, 2023

stokito commented Aug 4, 2023

stokito commented Aug 4, 2023

BKPepe commented Aug 18, 2023

stokito commented Aug 18, 2023

stokito commented Feb 4, 2024

BKPepe commented Feb 4, 2024

stokito commented Feb 6, 2024

stangri commented Feb 8, 2024

BKPepe commented Feb 8, 2024 via email

stokito commented Feb 8, 2024

BKPepe commented Feb 8, 2024 via email

stokito commented Feb 8, 2024

tor-hs: use named sections #21642

Are you sure you want to change the base?

tor-hs: use named sections #21642

Conversation

stokito commented Jul 23, 2023

stokito commented Jul 23, 2023 • edited Loading

BKPepe commented Jul 24, 2023

stokito commented Jul 24, 2023

stokito commented Aug 4, 2023

stokito commented Aug 4, 2023

BKPepe commented Aug 18, 2023

stokito commented Aug 18, 2023

stokito commented Feb 4, 2024

BKPepe commented Feb 4, 2024

stokito commented Feb 6, 2024

stangri commented Feb 8, 2024

BKPepe commented Feb 8, 2024 via email

stokito commented Feb 8, 2024

BKPepe commented Feb 8, 2024 via email

stokito commented Feb 8, 2024

stokito commented Jul 23, 2023 •

edited

Loading