Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Validate onion URLs before provisioning #240

Closed
heartsucker opened this issue Jan 24, 2019 · 4 comments · Fixed by #379
Closed

Validate onion URLs before provisioning #240

heartsucker opened this issue Jan 24, 2019 · 4 comments · Fixed by #379

Comments

@heartsucker
Copy link

The sd-whonix VM will fail to start the tor process if the onion address is malformed.

@eloquence
Copy link
Member

Is this still occurring, and if so, does it cause make all to hang when it does?

@redshiftzero
Copy link
Contributor

also we should validate the auth cookie (cc #321 as we'll need to do the same for v3), the expected format for v2 is:

Valid onion addresses contain 16 characters in a-z2-7 plus
".onion", and valid auth cookies contain 22 characters in
A-Za-z0-9+/

@sssoleileraaa
Copy link
Contributor

So I think make all used to hang here but now a Tor Config Check error window pops up with a message that says the onion address has the wrong format. I think validating the auth cookie would be an improvment, but also I wonder if there is a better error we could show that says the config.json file contains an error that points to the malformed json value?

@conorsch
Copy link
Contributor

we'll need to do the same for v3

Nearest I can figure for the v3 validation options is:

  • v3 Onion URL regex: ^[a-z2-7]{56}\.onion$
  • v3 Onion auth regex: ^[A-Z2-7]{52}$

That's based on my read of https://github.com/torproject/torspec/blob/master/rend-spec-v3.txt. Since both values are base32-encoded, that's the target charset to match against, with a known length for each value, to boot. Will update #379 accordingly, now that #321 is resolved.

@rmol rmol closed this as completed in #379 Dec 20, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants