From d023de945a7037bb4ec66f81aa83588d53184099 Mon Sep 17 00:00:00 2001 From: Mike Tigas Date: Fri, 12 Oct 2018 17:15:11 -0400 Subject: [PATCH 1/2] tweak manpage bits about v3 onion svc client auth make a couple things more explicit, like not needing to set "HiddenServiceAuthorizeClient" & etc --- doc/tor.1.txt | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 406372433f..2d5237c843 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1090,14 +1090,16 @@ The following options are useful only for clients (that is, if **HiddenServiceAuthorizeClient** option. [[ClientOnionAuthDir]] **ClientOnionAuthDir** __path__:: - Path to the directory containing the hidden service authorization file. The - files MUST have the suffix ".auth_private". Each file is for a single - onion address and their format is: + Path to the directory containing v3 hidden service authorization files. + Each file is for a single onion address, and the files MUST have the suffix + ".auth_private" (i.e. "bob_onion.auth_private"). The content format MUST be: + :descriptor:x25519: + - The MUST NOT have the ".onion" suffix. See the - rend-spec-v3.txt Appendix G for more information. + The MUST NOT have the ".onion" suffix. The + is the base32 representation of the raw key bytes + only (32 bytes for x25519). See Appendix G in the rend-spec-v3.txt file of + https://spec.torproject.org/[torspec] for more information. [[LongLivedPorts]] **LongLivedPorts** __PORTS__:: A list of ports for services that tend to have long-running connections @@ -2839,7 +2841,8 @@ The following options are used to configure a hidden service. clients without authorization any more. Generated authorization data can be found in the hostname file. Clients need to put this authorization data in their configuration file using **HidServAuth**. This option is only for v2 - services. + services; v3 services configure client authentication in a subdirectory of + HiddenServiceDir instead (see the **Client Authorization** section). [[HiddenServiceAllowUnknownPorts]] **HiddenServiceAllowUnknownPorts** **0**|**1**:: If set to 1, then connections to unrecognized ports do not cause the @@ -2941,19 +2944,26 @@ Client Authorization (Version 3 only) To configure client authorization on the service side, the -"/authorized_clients/" needs to exists. Each file in that -directory should be suffixed with ".auth" (the file name is irrelevant) and -its content format MUST be: +"/authorized_clients/" directory needs to exist. Each file +in that directory should be suffixed with ".auth" (i.e. "alice.auth"; the +file name is irrelevant) and its content format MUST be: :: The supported are: "descriptor". The supported are: -"x25519". Each file MUST contain one line only. Any malformed file will be -ignored. +"x25519". The is the base32 representation of the raw +key bytes only (32 bytes for x25519). + +Each file MUST contain one line only. Any malformed file will be +ignored. Client authorization will only be enabled for the service if tor +successfully loads at least one authorization file. Note that once you've configured client authorization, anyone else with the address won't be able to access it from this point on. If no authorization is -configured, the service will be accessible to all. +configured, the service will be accessible to anyone with the onion address. + +See the Appendix G in the rend-spec-v3.txt file of +https://spec.torproject.org/[torspec] for more information. TESTING NETWORK OPTIONS ----------------------- From 6c9d678ff66d012b4c8009c6ad44409c7368ed69 Mon Sep 17 00:00:00 2001 From: David Goulet Date: Tue, 30 Oct 2018 11:28:53 -0400 Subject: [PATCH 2/2] hs-v3: Add changes file for 28026 Signed-off-by: David Goulet --- changes/ticket28026 | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 changes/ticket28026 diff --git a/changes/ticket28026 b/changes/ticket28026 new file mode 100644 index 0000000000..a6911c2cab --- /dev/null +++ b/changes/ticket28026 @@ -0,0 +1,3 @@ + o Documentation (hidden service manpage): + - Improve HSv3 client authorization by making some options more explicit + and detailed. Closes ticket 28026. Patch by "mtigas".