onionshare_cli 2.3.3__tar.gz → 2.5__tar.gz

{onionshare_cli-2.3.3 → onionshare_cli-2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: onionshare-cli
-Version: 2.3.3
+Version: 2.5
 Summary: OnionShare lets you securely and anonymously send and receive files. It works by starting a web server, making it accessible as a Tor onion service, and generating an unguessable web address so others can download files from you, or upload files to you. It does _not_ require setting up a separate server or using a third party file-sharing service.
 License: GPLv3+
 Author: Micah Lee
@@ -13,23 +13,24 @@ Classifier: License :: OSI Approved :: GNU General Public License v3 or later (G
 Classifier: License :: Other/Proprietary License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.6
 Classifier: Programming Language :: Python :: 3.7
 Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Topic :: Communications :: File Sharing
 Classifier: Topic :: Security :: Cryptography
+Requires-Dist: cepa (==1.8.3)
 Requires-Dist: click
 Requires-Dist: colorama
 Requires-Dist: eventlet
 Requires-Dist: flask (==1.1.4)
-Requires-Dist: flask-httpauth
 Requires-Dist: flask-socketio (==5.0.1)
+Requires-Dist: gevent-websocket
 Requires-Dist: psutil
-Requires-Dist: pycryptodome
+Requires-Dist: pynacl
 Requires-Dist: pysocks
 Requires-Dist: requests[socks]
 Requires-Dist: setuptools
-Requires-Dist: stem
 Requires-Dist: unidecode
 Requires-Dist: urllib3

{onionshare_cli-2.3.3 → onionshare_cli-2.5}/onionshare_cli/__init__.py

@@ -2,7 +2,7 @@
 """
 OnionShare | https://onionshare.org/
 
-Copyright (C) 2014-2021 Micah Lee, et al. <micah@micahflee.com>
+Copyright (C) 2014-2022 Micah Lee, et al. <micah@micahflee.com>
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -28,24 +28,11 @@ from datetime import timedelta
 
 from .common import Common, CannotFindTor
 from .web import Web
-from .onion import (
-    TorErrorProtocolError,
-    TorTooOldEphemeral,
-    TorTooOldStealth,
-    Onion,
-)
+from .onion import TorErrorProtocolError, TorTooOldEphemeral, TorTooOldStealth, Onion
 from .onionshare import OnionShare
 from .mode_settings import ModeSettings
 
 
-def build_url(mode_settings, app, web):
-    # Build the URL
-    if mode_settings.get("general", "public"):
-        return f"http://{app.onion_host}"
-    else:
-        return f"http://onionshare:{web.password}@{app.onion_host}"
-
-
 def main(cwd=None):
     """
     The main() function implements all of the logic that the command-line version of
@@ -102,18 +89,13 @@ def main(cwd=None):
         help="Filename of persistent session",
     )
     # General args
-    parser.add_argument(
-        "--title",
-        metavar="TITLE",
-        default=None,
-        help="Set a title",
-    )
+    parser.add_argument("--title", metavar="TITLE", default=None, help="Set a title")
     parser.add_argument(
         "--public",
         action="store_true",
         dest="public",
         default=False,
-        help="Don't use a password",
+        help="Don't use a private key",
     )
     parser.add_argument(
         "--auto-start-timer",
@@ -129,20 +111,6 @@ def main(cwd=None):
         default=0,
         help="Stop onion service at schedule time (N seconds from now)",
     )
-    parser.add_argument(
-        "--legacy",
-        action="store_true",
-        dest="legacy",
-        default=False,
-        help="Use legacy address (v2 onion service, not recommended)",
-    )
-    parser.add_argument(
-        "--client-auth",
-        action="store_true",
-        dest="client_auth",
-        default=False,
-        help="Use client authorization (requires --legacy)",
-    )
     # Share args
     parser.add_argument(
         "--no-autostop-sharing",
@@ -182,7 +150,13 @@ def main(cwd=None):
         action="store_true",
         dest="disable_csp",
         default=False,
-        help="Publish website: Disable Content Security Policy header (allows your website to use third-party resources)",
+        help="Publish website: Disable the default Content Security Policy header (allows your website to use third-party resources)",
+    )
+    parser.add_argument(
+        "--custom_csp",
+        metavar="custom_csp",
+        default=None,
+        help="Publish website: Set a custom Content Security Policy header",
     )
     # Other
     parser.add_argument(
@@ -215,35 +189,18 @@ def main(cwd=None):
     public = bool(args.public)
     autostart_timer = int(args.autostart_timer)
     autostop_timer = int(args.autostop_timer)
-    legacy = bool(args.legacy)
-    client_auth = bool(args.client_auth)
     autostop_sharing = not bool(args.no_autostop_sharing)
     data_dir = args.data_dir
     webhook_url = args.webhook_url
     disable_text = args.disable_text
     disable_files = args.disable_files
     disable_csp = bool(args.disable_csp)
+    custom_csp = args.custom_csp
     verbose = bool(args.verbose)
 
-    if receive:
-        mode = "receive"
-    elif website:
-        mode = "website"
-    elif chat:
-        mode = "chat"
-    else:
-        mode = "share"
-
     # Verbose mode?
     common.verbose = verbose
 
-    # client_auth can only be set if legacy is also set
-    if client_auth and not legacy:
-        print(
-            "Client authentication (--client-auth) is only supported with with legacy onion services (--legacy)"
-        )
-        sys.exit()
-
     # Re-load settings, if a custom config was passed in
     if config_filename:
         common.load_settings(config_filename)
@@ -254,18 +211,26 @@ def main(cwd=None):
     if persistent_filename:
         mode_settings = ModeSettings(common, persistent_filename)
         mode_settings.set("persistent", "enabled", True)
-        mode_settings.set("persistent", "mode", mode)
     else:
         mode_settings = ModeSettings(common)
 
+    if receive:
+        mode = "receive"
+    elif website:
+        mode = "website"
+    elif chat:
+        mode = "chat"
+    else:
+        mode = "share"
+
     if mode_settings.just_created:
         # This means the mode settings were just created, not loaded from disk
         mode_settings.set("general", "title", title)
         mode_settings.set("general", "public", public)
         mode_settings.set("general", "autostart_timer", autostart_timer)
         mode_settings.set("general", "autostop_timer", autostop_timer)
-        mode_settings.set("general", "legacy", legacy)
-        mode_settings.set("general", "client_auth", client_auth)
+        if persistent_filename:
+            mode_settings.set("persistent", "mode", mode)
         if mode == "share":
             mode_settings.set("share", "autostop_sharing", autostop_sharing)
         if mode == "receive":
@@ -276,7 +241,15 @@ def main(cwd=None):
             mode_settings.set("receive", "disable_text", disable_text)
             mode_settings.set("receive", "disable_files", disable_files)
         if mode == "website":
-            mode_settings.set("website", "disable_csp", disable_csp)
+            if disable_csp and custom_csp:
+                print("You cannot disable the CSP and set a custom one. Either set --disable-csp or --custom-csp but not both.")
+                sys.exit()
+            if disable_csp:
+                mode_settings.set("website", "disable_csp", True)
+                mode_settings.set("website", "custom_csp", None)
+            if custom_csp:
+                mode_settings.set("website", "custom_csp", custom_csp)
+                mode_settings.set("website", "disable_csp", False)
     else:
         # See what the persistent mode was
         mode = mode_settings.get("persistent", "mode")
@@ -352,11 +325,6 @@ def main(cwd=None):
     try:
         common.settings.load()
 
-        if mode_settings.get("general", "public"):
-            web.password = None
-        else:
-            web.generate_password(mode_settings.get("onion", "password"))
-
         # Receive mode needs to know the tor proxy details for webhooks
         if mode == "receive":
             if local_only:
@@ -381,7 +349,7 @@ def main(cwd=None):
                 sys.exit()
 
             app.start_onion_service(mode, mode_settings, False)
-            url = build_url(mode_settings, app, web)
+            url = f"http://{app.onion_host}"
             schedule = datetime.now() + timedelta(seconds=autostart_timer)
             if mode == "receive":
                 print(
@@ -394,21 +362,21 @@ def main(cwd=None):
                     "what you are doing."
                 )
                 print("")
-                if mode_settings.get("general", "client_auth"):
+                if not mode_settings.get("general", "public"):
                     print(
-                        f"Give this address and HidServAuth lineto your sender, and tell them it won't be accessible until: {schedule.strftime('%I:%M:%S%p, %b %d, %y')}"
+                        f"Give this address and private key to your sender, and tell them it won't be accessible until: {schedule.strftime('%I:%M:%S%p, %b %d, %y')}"
                     )
-                    print(app.auth_string)
+                    print(f"Private key: {app.auth_string}")
                 else:
                     print(
                         f"Give this address to your sender, and tell them it won't be accessible until: {schedule.strftime('%I:%M:%S%p, %b %d, %y')}"
                     )
             else:
-                if mode_settings.get("general", "client_auth"):
+                if not mode_settings.get("general", "public"):
                     print(
-                        f"Give this address and HidServAuth line to your recipient, and tell them it won't be accessible until: {schedule.strftime('%I:%M:%S%p, %b %d, %y')}"
+                        f"Give this address and private key to your recipient, and tell them it won't be accessible until: {schedule.strftime('%I:%M:%S%p, %b %d, %y')}"
                     )
-                    print(app.auth_string)
+                    print(f"Private key: {app.auth_string}")
                 else:
                     print(
                         f"Give this address to your recipient, and tell them it won't be accessible until: {schedule.strftime('%I:%M:%S%p, %b %d, %y')}"
@@ -426,7 +394,6 @@ def main(cwd=None):
         sys.exit()
     except (TorTooOldEphemeral, TorTooOldStealth, TorErrorProtocolError) as e:
         print("")
-        print(e.args[0])
         sys.exit()
 
     if mode == "website":
@@ -447,7 +414,7 @@ def main(cwd=None):
             sys.exit(1)
 
         # Warn about sending large files over Tor
-        if web.share_mode.download_filesize >= 157286400:  # 150mb
+        if web.share_mode.download_filesize >= 157_286_400:  # 150mb
             print("")
             print("Warning: Sending a large share could take hours")
             print("")
@@ -458,21 +425,14 @@ def main(cwd=None):
     t.start()
 
     try:  # Trap Ctrl-C
-        # Wait for web.generate_password() to finish running
         time.sleep(0.2)
 
         # start auto-stop timer thread
         if app.autostop_timer > 0:
             app.autostop_timer_thread.start()
 
-        # Save the web password if we are using a persistent private key
-        if mode_settings.get("persistent", "enabled"):
-            if not mode_settings.get("onion", "password"):
-                mode_settings.set("onion", "password", web.password)
-                # mode_settings.save()
-
         # Build the URL
-        url = build_url(mode_settings, app, web)
+        url = f"http://{app.onion_host}"
 
         print("")
         if autostart_timer > 0:
@@ -490,21 +450,21 @@ def main(cwd=None):
                 )
                 print("")
 
-                if mode_settings.get("general", "client_auth"):
-                    print("Give this address and HidServAuth to the sender:")
+                if mode_settings.get("general", "public"):
+                    print("Give this address to the sender:")
                     print(url)
-                    print(app.auth_string)
                 else:
-                    print("Give this address to the sender:")
+                    print("Give this address and private key to the sender:")
                     print(url)
+                    print(f"Private key: {app.auth_string}")
             else:
-                if mode_settings.get("general", "client_auth"):
-                    print("Give this address and HidServAuth line to the recipient:")
+                if mode_settings.get("general", "public"):
+                    print("Give this address to the recipient:")
                     print(url)
-                    print(app.auth_string)
                 else:
-                    print("Give this address to the recipient:")
+                    print("Give this address and private key to the recipient:")
                     print(url)
+                    print(f"Private key: {app.auth_string}")
         print("")
         print("Press Ctrl+C to stop the server")
 
@@ -513,13 +473,13 @@ def main(cwd=None):
             if app.autostop_timer > 0:
                 # if the auto-stop timer was set and has run out, stop the server
                 if not app.autostop_timer_thread.is_alive():
-                    if mode == "share" or (mode == "website"):
+                    if mode == "share":
                         # If there were no attempts to download the share, or all downloads are done, we can stop
                         if web.share_mode.cur_history_id == 0 or web.done:
                             print("Stopped because auto-stop timer ran out")
                             web.stop(app.port)
                             break
-                    if mode == "receive":
+                    elif mode == "receive":
                         if (
                             web.receive_mode.cur_history_id == 0
                             or not web.receive_mode.uploads_in_progress
@@ -528,6 +488,11 @@ def main(cwd=None):
                             web.stop(app.port)
                             break
                         web.receive_mode.can_upload = False
+                    else:
+                        # website or chat mode
+                        print("Stopped because auto-stop timer ran out")
+                        web.stop(app.port)
+                        break
             # Allow KeyboardInterrupt exception to be handled with threads
             # https://stackoverflow.com/questions/3788208/python-threading-ignores-keyboardinterrupt-exception
             time.sleep(0.2)

onionshare_cli-2.5/onionshare_cli/censorship.py

@@ -0,0 +1,200 @@
+# -*- coding: utf-8 -*-
+"""
+OnionShare | https://onionshare.org/
+
+Copyright (C) 2014-2022 Micah Lee, et al. <micah@micahflee.com>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+"""
+import requests
+
+from .meek import MeekNotRunning
+
+
+class CensorshipCircumvention(object):
+    """
+    Connect to the Tor Moat APIs to retrieve censorship
+    circumvention recommendations or the latest bridges.
+
+    We support reaching this API over Tor, or Meek
+    (domain fronting) if Tor is not connected.
+    """
+
+    def __init__(self, common, meek=None, onion=None):
+        """
+        Set up the CensorshipCircumvention object to hold
+        common and meek objects.
+        """
+        self.common = common
+        self.common.log("CensorshipCircumvention", "__init__")
+        self.api_proxies = {}
+        if meek:
+            self.meek = meek
+            if not self.meek.meek_proxies:
+                raise MeekNotRunning()
+            else:
+                self.common.log(
+                    "CensorshipCircumvention",
+                    "__init__",
+                    "Using Meek with CensorShipCircumvention API",
+                )
+                self.api_proxies = self.meek.meek_proxies
+        if onion:
+            self.onion = onion
+            if not self.onion.is_authenticated:
+                return False
+            else:
+                self.common.log(
+                    "CensorshipCircumvention",
+                    "__init__",
+                    "Using Tor with CensorShipCircumvention API",
+                )
+                (socks_address, socks_port) = self.onion.get_tor_socks_port()
+                self.api_proxies = {
+                    "http": f"socks5h://{socks_address}:{socks_port}",
+                    "https": f"socks5h://{socks_address}:{socks_port}",
+                }
+
+    def request_map(self, country=False):
+        """
+        Retrieves the Circumvention map from Tor Project and store it
+        locally for further look-ups if required.
+
+        Optionally pass a country code in order to get recommended settings
+        just for that country.
+
+        Note that this API endpoint doesn't return actual bridges,
+        it just returns the recommended bridge type countries.
+        """
+        if not self.api_proxies:
+            return False
+        endpoint = "https://bridges.torproject.org/moat/circumvention/map"
+        data = {}
+        if country:
+            data = {"country": country}
+
+        r = requests.post(
+            endpoint,
+            json=data,
+            headers={"Content-Type": "application/vnd.api+json"},
+            proxies=self.api_proxies,
+        )
+        if r.status_code != 200:
+            self.common.log(
+                "CensorshipCircumvention",
+                "censorship_obtain_map",
+                f"status_code={r.status_code}",
+            )
+            return False
+
+        result = r.json()
+
+        if "errors" in result:
+            self.common.log(
+                "CensorshipCircumvention",
+                "censorship_obtain_map",
+                f"errors={result['errors']}",
+            )
+            return False
+
+        return result
+
+    def request_settings(self, country=False, transports=False):
+        """
+        Retrieves the Circumvention Settings from Tor Project, which
+        will return recommended settings based on the country code of
+        the requesting IP.
+
+        Optionally, a country code can be specified in order to override
+        the IP detection.
+
+        Optionally, a list of transports can be specified in order to
+        return recommended settings for just that transport type.
+        """
+        if not self.api_proxies:
+            return False
+        endpoint = "https://bridges.torproject.org/moat/circumvention/settings"
+        data = {}
+        if country:
+            data = {"country": country}
+        if transports:
+            data.append({"transports": transports})
+        r = requests.post(
+            endpoint,
+            json=data,
+            headers={"Content-Type": "application/vnd.api+json"},
+            proxies=self.api_proxies,
+        )
+        if r.status_code != 200:
+            self.common.log(
+                "CensorshipCircumvention",
+                "censorship_obtain_settings",
+                f"status_code={r.status_code}",
+            )
+            return False
+
+        result = r.json()
+
+        if "errors" in result:
+            self.common.log(
+                "CensorshipCircumvention",
+                "censorship_obtain_settings",
+                f"errors={result['errors']}",
+            )
+            return False
+
+        # There are no settings - perhaps this country doesn't require censorship circumvention?
+        # This is not really an error, so we can just check if False and assume direct Tor
+        # connection will work.
+        if not "settings" in result:
+            self.common.log(
+                "CensorshipCircumvention",
+                "censorship_obtain_settings",
+                "No settings found for this country",
+            )
+            return False
+
+        return result
+
+    def request_builtin_bridges(self):
+        """
+        Retrieves the list of built-in bridges from the Tor Project.
+        """
+        if not self.api_proxies:
+            return False
+        endpoint = "https://bridges.torproject.org/moat/circumvention/builtin"
+        r = requests.post(
+            endpoint,
+            headers={"Content-Type": "application/vnd.api+json"},
+            proxies=self.api_proxies,
+        )
+        if r.status_code != 200:
+            self.common.log(
+                "CensorshipCircumvention",
+                "censorship_obtain_builtin_bridges",
+                f"status_code={r.status_code}",
+            )
+            return False
+
+        result = r.json()
+
+        if "errors" in result:
+            self.common.log(
+                "CensorshipCircumvention",
+                "censorship_obtain_builtin_bridges",
+                f"errors={result['errors']}",
+            )
+            return False
+
+        return result