onionshare_cli 2.5__tar.gz → 2.6__tar.gz

{onionshare_cli-2.5 → onionshare_cli-2.6}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.1
 Name: onionshare-cli
-Version: 2.5
+Version: 2.6
 Summary: OnionShare lets you securely and anonymously send and receive files. It works by starting a web server, making it accessible as a Tor onion service, and generating an unguessable web address so others can download files from you, or upload files to you. It does _not_ require setting up a separate server or using a third party file-sharing service.
 License: GPLv3+
 Author: Micah Lee
 Author-email: micah@micahflee.com
-Requires-Python: >=3.6,<4.0
+Requires-Python: >=3.7,<4.0
 Classifier: Environment :: Web Environment
 Classifier: Framework :: Flask
 Classifier: Intended Audience :: End Users/Desktop
@@ -13,24 +13,25 @@ Classifier: License :: OSI Approved :: GNU General Public License v3 or later (G
 Classifier: License :: Other/Proprietary License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.6
 Classifier: Programming Language :: Python :: 3.7
 Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3
 Classifier: Topic :: Communications :: File Sharing
 Classifier: Topic :: Security :: Cryptography
-Requires-Dist: cepa (==1.8.3)
 Requires-Dist: click
 Requires-Dist: colorama
 Requires-Dist: eventlet
-Requires-Dist: flask (==1.1.4)
-Requires-Dist: flask-socketio (==5.0.1)
+Requires-Dist: flask (==2.0.3)
+Requires-Dist: flask-socketio (==5.3.1)
 Requires-Dist: gevent-websocket
 Requires-Dist: psutil
 Requires-Dist: pynacl
 Requires-Dist: pysocks
 Requires-Dist: requests[socks]
 Requires-Dist: setuptools
+Requires-Dist: stem (==1.8.1)
 Requires-Dist: unidecode
 Requires-Dist: urllib3
+Requires-Dist: werkzeug (>=2.0.3,<2.1.0)

onionshare_cli-2.6/onionshare_cli/censorship.py

@@ -0,0 +1,311 @@
+# -*- coding: utf-8 -*-
+"""
+OnionShare | https://onionshare.org/
+
+Copyright (C) 2014-2022 Micah Lee, et al. <micah@micahflee.com>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+"""
+import requests
+
+
+class CensorshipCircumventionError(Exception):
+    """
+    There was a problem connecting to the Tor CensorshipCircumvention API.
+    """
+
+
+class CensorshipCircumvention(object):
+    """
+    Connect to the Tor Moat APIs to retrieve censorship
+    circumvention recommendations or the latest bridges.
+
+    We support reaching this API over Tor, or Meek
+    (domain fronting) if Tor is not connected.
+    """
+
+    def __init__(self, common, meek=None, onion=None):
+        """
+        Set up the CensorshipCircumvention object to hold
+        common and meek objects.
+        """
+        self.common = common
+        self.common.log("CensorshipCircumvention", "__init__")
+        self.api_proxies = {}
+        if meek:
+            self.meek = meek
+            self.common.log(
+                "CensorshipCircumvention",
+                "__init__",
+                "Using Meek with CensorshipCircumvention API",
+            )
+            self.api_proxies = self.meek.meek_proxies
+        if onion:
+            self.onion = onion
+            if not self.onion.is_authenticated:
+                return False
+            else:
+                self.common.log(
+                    "CensorshipCircumvention",
+                    "__init__",
+                    "Using Tor with CensorshipCircumvention API",
+                )
+                (socks_address, socks_port) = self.onion.get_tor_socks_port()
+                self.api_proxies = {
+                    "http": f"socks5h://{socks_address}:{socks_port}",
+                    "https": f"socks5h://{socks_address}:{socks_port}",
+                }
+
+    def request_map(self, country=False):
+        """
+        Retrieves the Circumvention map from Tor Project and store it
+        locally for further look-ups if required.
+
+        Optionally pass a country code in order to get recommended settings
+        just for that country.
+
+        Note that this API endpoint doesn't return actual bridges,
+        it just returns the recommended bridge type countries.
+        """
+        self.common.log("CensorshipCircumvention", "request_map", f"country={country}")
+        if not self.api_proxies:
+            return False
+        endpoint = "https://bridges.torproject.org/moat/circumvention/map"
+        data = {}
+        if country:
+            data = {"country": country}
+
+        try:
+            r = requests.post(
+                endpoint,
+                json=data,
+                headers={"Content-Type": "application/vnd.api+json"},
+                proxies=self.api_proxies,
+            )
+            if r.status_code != 200:
+                self.common.log(
+                    "CensorshipCircumvention",
+                    "request_map",
+                    f"status_code={r.status_code}",
+                )
+                return False
+
+            result = r.json()
+
+            if "errors" in result:
+                self.common.log(
+                    "CensorshipCircumvention",
+                    "request_map",
+                    f"errors={result['errors']}",
+                )
+                return False
+
+            return result
+        except requests.exceptions.RequestException as e:
+            raise CensorshipCircumventionError(e)
+
+    def request_settings(self, country=False, transports=False):
+        """
+        Retrieves the Circumvention Settings from Tor Project, which
+        will return recommended settings based on the country code of
+        the requesting IP.
+
+        Optionally, a country code can be specified in order to override
+        the IP detection.
+
+        Optionally, a list of transports can be specified in order to
+        return recommended settings for just that transport type.
+        """
+        self.common.log(
+            "CensorshipCircumvention",
+            "request_settings",
+            f"country={country}, transports={transports}",
+        )
+        if not self.api_proxies:
+            return False
+        endpoint = "https://bridges.torproject.org/moat/circumvention/settings"
+        data = {}
+        if country:
+            self.common.log(
+                "CensorshipCircumvention",
+                "request_settings",
+                f"Trying to obtain bridges for country={country}",
+            )
+            data = {"country": country}
+        if transports:
+            data.append({"transports": transports})
+        try:
+            r = requests.post(
+                endpoint,
+                json=data,
+                headers={"Content-Type": "application/vnd.api+json"},
+                proxies=self.api_proxies,
+            )
+            if r.status_code != 200:
+                self.common.log(
+                    "CensorshipCircumvention",
+                    "request_settings",
+                    f"status_code={r.status_code}",
+                )
+                return False
+
+            result = r.json()
+            self.common.log(
+                "CensorshipCircumvention",
+                "request_settings",
+                f"result={result}",
+            )
+
+            if "errors" in result:
+                self.common.log(
+                    "CensorshipCircumvention",
+                    "request_settings",
+                    f"errors={result['errors']}",
+                )
+                return False
+
+            # There are no settings - perhaps this country doesn't require censorship circumvention?
+            # This is not really an error, so we can just check if False and assume direct Tor
+            # connection will work.
+            if not "settings" in result or result["settings"] is None:
+                self.common.log(
+                    "CensorshipCircumvention",
+                    "request_settings",
+                    "No settings found for this country",
+                )
+                return False
+
+            return result
+        except requests.exceptions.RequestException as e:
+            raise CensorshipCircumventionError(e)
+
+    def request_builtin_bridges(self):
+        """
+        Retrieves the list of built-in bridges from the Tor Project.
+        """
+        if not self.api_proxies:
+            return False
+        endpoint = "https://bridges.torproject.org/moat/circumvention/builtin"
+        try:
+            r = requests.post(
+                endpoint,
+                headers={"Content-Type": "application/vnd.api+json"},
+                proxies=self.api_proxies,
+            )
+            if r.status_code != 200:
+                self.common.log(
+                    "CensorshipCircumvention",
+                    "request_builtin_bridges",
+                    f"status_code={r.status_code}",
+                )
+                return False
+
+            result = r.json()
+
+            if "errors" in result:
+                self.common.log(
+                    "CensorshipCircumvention",
+                    "request_builtin_bridges",
+                    f"errors={result['errors']}",
+                )
+                return False
+
+            return result
+        except requests.exceptions.RequestException as e:
+            raise CensorshipCircumventionError(e)
+
+    def save_settings(self, settings, bridge_settings):
+        """
+        Checks the bridges and saves them in settings.
+        """
+        self.common.log(
+            "CensorshipCircumvention",
+            "save_settings",
+            f"bridge_settings: {bridge_settings}",
+        )
+
+        bridges_ok = False
+        self.settings = settings
+
+        # @TODO there might be several bridge types recommended.
+        # Should we attempt to iterate over each type if one of them fails to connect?
+        # But if so, how to stop it starting 3 separate Tor connection threads?
+        # for bridges in request_bridges["settings"]:
+        bridges = bridge_settings["settings"][0]["bridges"]
+        bridge_strings = bridges["bridge_strings"]
+
+        self.settings.set("bridges_type", "custom")
+
+        # Sanity check the bridges provided from the Tor API before saving
+        bridges_checked = self.common.check_bridges_valid(bridge_strings)
+
+        if bridges_checked:
+            self.settings.set("bridges_custom", "\n".join(bridges_checked))
+            bridges_ok = True
+
+        # If we got any good bridges, save them to settings and return.
+        if bridges_ok:
+            self.common.log(
+                "CensorshipCircumvention",
+                "save_settings",
+                "Saving settings with automatically-obtained bridges",
+            )
+            self.settings.set("bridges_enabled", True)
+            self.settings.save()
+            return True
+        else:
+            self.common.log(
+                "CensorshipCircumvention",
+                "save_settings",
+                "Could not use any of the obtained bridges.",
+            )
+            return False
+
+    def request_default_bridges(self):
+        """
+        Retrieves the list of default fall-back bridges from the Tor Project.
+
+        These are intended for when no censorship settings were found for a
+        specific country, but maybe there was some connection issue anyway.
+        """
+        if not self.api_proxies:
+            return False
+        endpoint = "https://bridges.torproject.org/moat/circumvention/defaults"
+        try:
+            r = requests.get(
+                endpoint,
+                headers={"Content-Type": "application/vnd.api+json"},
+                proxies=self.api_proxies,
+            )
+            if r.status_code != 200:
+                self.common.log(
+                    "CensorshipCircumvention",
+                    "request_default_bridges",
+                    f"status_code={r.status_code}",
+                )
+                return False
+
+            result = r.json()
+
+            if "errors" in result:
+                self.common.log(
+                    "CensorshipCircumvention",
+                    "request_default_bridges",
+                    f"errors={result['errors']}",
+                )
+                return False
+
+            return result
+        except requests.exceptions.RequestException as e:
+            raise CensorshipCircumventionError(e)

{onionshare_cli-2.5 → onionshare_cli-2.6}/onionshare_cli/common.py

@@ -28,6 +28,7 @@ import sys
 import threading
 import time
 import shutil
+import re
 from pkg_resources import resource_filename
 
 import colorama
@@ -312,7 +313,6 @@ class Common:
         """
         Returns the absolute path of a resource
         """
-        self.log("Common", "get_resource_path", f"filename={filename}")
         path = resource_filename("onionshare_cli", os.path.join("resources", filename))
         self.log("Common", "get_resource_path", f"filename={filename}, path={path}")
         return path
@@ -332,21 +332,27 @@ class Common:
             # In Windows, the Tor binaries are in the onionshare package, not the onionshare_cli package
             base_path = self.get_resource_path("tor")
             base_path = base_path.replace("onionshare_cli", "onionshare")
-            tor_path = os.path.join(base_path, "Tor", "tor.exe")
+            tor_path = os.path.join(base_path, "tor.exe")
 
             # If tor.exe isn't there, mayber we're running from the source tree
             if not os.path.exists(tor_path):
+                self.log(
+                    "Common", "get_tor_paths", f"Cannot find tor.exe at {tor_path}"
+                )
                 base_path = os.path.join(os.getcwd(), "onionshare", "resources", "tor")
 
-                tor_path = os.path.join(base_path, "Tor", "tor.exe")
+                tor_path = os.path.join(base_path, "tor.exe")
                 if not os.path.exists(tor_path):
+                    self.log(
+                        "Common", "get_tor_paths", f"Cannot find tor.exe at {tor_path}"
+                    )
                     raise CannotFindTor()
 
-            obfs4proxy_file_path = os.path.join(base_path, "Tor", "obfs4proxy.exe")
-            snowflake_file_path = os.path.join(base_path, "Tor", "snowflake-client.exe")
-            meek_client_file_path = os.path.join(base_path, "Tor", "meek-client.exe")
-            tor_geo_ip_file_path = os.path.join(base_path, "Data", "Tor", "geoip")
-            tor_geo_ipv6_file_path = os.path.join(base_path, "Data", "Tor", "geoip6")
+            obfs4proxy_file_path = os.path.join(base_path, "obfs4proxy.exe")
+            snowflake_file_path = os.path.join(base_path, "snowflake-client.exe")
+            meek_client_file_path = os.path.join(base_path, "meek-client.exe")
+            tor_geo_ip_file_path = os.path.join(base_path, "geoip")
+            tor_geo_ipv6_file_path = os.path.join(base_path, "geoip6")
 
         elif self.platform == "Darwin":
             # Let's see if we have tor binaries in the onionshare GUI package
@@ -467,6 +473,40 @@ class Common:
         r = random.SystemRandom()
         return "-".join(r.choice(wordlist) for _ in range(word_count))
 
+    def check_bridges_valid(self, bridges):
+        """
+        Does a regex check against a supplied list of bridges, to make sure they
+        are valid strings depending on the bridge type.
+        """
+        valid_bridges = []
+        self.log("Common", "check_bridges_valid", "Checking bridge syntax")
+        for bridge in bridges:
+            if bridge != "":
+                # Check the syntax of the custom bridge to make sure it looks legitimate
+                ipv4_pattern = re.compile(
+                    "(obfs4\s+)?(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):([0-9]+)(\s+)([A-Z0-9]+)(.+)$"
+                )
+                ipv6_pattern = re.compile(
+                    "(obfs4\s+)?\[(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\]:[0-9]+\s+[A-Z0-9]+(.+)$"
+                )
+                meek_lite_pattern = re.compile(
+                    "(meek_lite)(\s)+([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+)(\s)+([0-9A-Z]+)(\s)+url=(.+)(\s)+front=(.+)"
+                )
+                snowflake_pattern = re.compile(
+                    "(snowflake)(\s)+([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+)(\s)+([0-9A-Z]+)"
+                )
+                if (
+                    ipv4_pattern.match(bridge)
+                    or ipv6_pattern.match(bridge)
+                    or meek_lite_pattern.match(bridge)
+                    or snowflake_pattern.match(bridge)
+                ):
+                    valid_bridges.append(bridge)
+        if valid_bridges:
+            return valid_bridges
+        else:
+            return False
+
     def is_flatpak(self):
         """
         Returns True if OnionShare is running in a Flatpak sandbox

{onionshare_cli-2.5 → onionshare_cli-2.6}/onionshare_cli/meek.py

@@ -69,7 +69,7 @@ class Meek(object):
         if self.meek_client_file_path is None or not os.path.exists(
             self.meek_client_file_path
         ):
-            raise MeekNotFound()
+            raise MeekNotFound(self.common)
 
         # Start the Meek Client as a subprocess.
         self.common.log("Meek", "start", "Starting meek client")
@@ -128,7 +128,7 @@ class Meek(object):
 
             if "CMETHOD-ERROR" in line:
                 self.cleanup()
-                raise MeekNotRunning()
+                raise MeekNotRunning(self.common, line)
                 break
 
         if self.meek_port:
@@ -137,9 +137,8 @@ class Meek(object):
                 "https": f"socks5h://{self.meek_host}:{self.meek_port}",
             }
         else:
-            self.common.log("Meek", "start", "Could not obtain the meek port")
             self.cleanup()
-            raise MeekNotRunning()
+            raise MeekNotRunning(self.common, "Could not obtain the meek port")
 
     def cleanup(self):
         """
@@ -182,8 +181,19 @@ class MeekNotRunning(Exception):
     number it started on, in order to do domain fronting.
     """
 
+    def __init__(self, common, info=None):
+        self.common = common
+        msg = "Meek experienced an error starting up"
+        if info:
+            msg = msg + f": {info}"
+        self.common.log("MeekNotRunning", "__init__", msg)
+
 
 class MeekNotFound(Exception):
     """
     We were unable to find the Meek Client binary.
     """
+
+    def __init__(self, common):
+        self.common = common
+        self.common.log("MeekNotFound", "__init__", "Could not find the meek binary")

{onionshare_cli-2.5 → onionshare_cli-2.6}/onionshare_cli/onion.py

@@ -954,20 +954,6 @@ class Onion(object):
                 "update_builtin_bridges",
                 f"Obtained bridges: {builtin_bridges}",
             )
-            if builtin_bridges["meek"]:
-                # Meek bridge needs to be defined as "meek_lite", not "meek",
-                # for it to work with obfs4proxy.
-                # We also refer to this bridge type as 'meek-azure' in our settings.
-                # So first, rename the key in the dict
-                builtin_bridges["meek-azure"] = builtin_bridges.pop("meek")
-                new_meek_bridges = []
-                # Now replace the values. They also need the url/front params appended
-                for item in builtin_bridges["meek-azure"]:
-                    newline = item.replace("meek", "meek_lite")
-                    new_meek_bridges.append(
-                        f"{newline} url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com"
-                    )
-                builtin_bridges["meek-azure"] = new_meek_bridges
             # Save the new settings
             self.settings.set("bridges_builtin", builtin_bridges)
             self.settings.save()

{onionshare_cli-2.5 → onionshare_cli-2.6}/onionshare_cli/resources/static/css/style.css

@@ -10,6 +10,7 @@
 body {
   margin: 0;
   font-family: Helvetica, sans-serif;
+  background-color: #fafafa;
 }
 
 .d-flex {
@@ -21,15 +22,14 @@ body {
 
 header {
   border-bottom: 1px solid rgba(0, 0, 0, 0.1);
-  background: #fcfcfc;
-  background: -webkit-linear-gradient(top, #fcfcfc 0%, #f2f2f2 100%);
-  padding: 0.8rem;
+  background: #fff;
+  padding: 1rem;
 }
 
 header .logo {
   vertical-align: middle;
-  width: 45px;
-  height: 45px;
+  width: 3rem;
+  height: 3rem;
 }
 
 header h1 {
@@ -37,23 +37,26 @@ header h1 {
   margin: 0 0 0 0.5rem;
   vertical-align: middle;
   font-weight: normal;
-  font-size: 1.5rem;
-  color: #666666;
+  font-size: 1.375rem;
+  color: #333;
+  position: relative;
+  top: .125rem;
 }
 
 header .information {
-  font-size: 1rem;
+  font-size: .875rem;
 }
 
 .button {
   color: #ffffff;
   background-color: #4e064f;
-  padding: 10px;
+  padding: .875rem 1rem;
   border: 0;
-  border-radius: 5px;
+  border-radius: .25rem;
   text-decoration: none;
   margin-left: 1rem;
   cursor: pointer;
+  font-weight: bold;
 }
 
 a.button:visited {
@@ -102,6 +105,9 @@ ul.breadcrumbs li a:link, ul.breadcrumbs li a:visited {
   width: 100%;
   margin: 0 auto;
   border-collapse: collapse;
+  font-size: .875rem;
+  color: #333;
+  background-color: #fff;
 }
 
 .file-list .heading {
@@ -109,7 +115,9 @@ ul.breadcrumbs li a:link, ul.breadcrumbs li a:visited {
   text-transform: uppercase;
   font-weight: normal;
   color: #666666;
-  padding: 0.5rem;
+  padding: 0.75rem;
+  font-size: .75rem;
+  letter-spacing: .0625rem;
 }
 
 .file-list div.d-flex {
@@ -119,16 +127,18 @@ ul.breadcrumbs li a:link, ul.breadcrumbs li a:visited {
 
 .file-list div.d-flex div {
   white-space: nowrap;
-  padding: 0.5rem 0.8rem 0.5rem 0.8rem;
+  padding: .625rem .75rem;
 }
 
 .file-list div.d-flex div img {
   vertical-align: middle;
   margin-right: 0.5rem;
+  width: 1.25rem;
+  height: 1.25rem;
 }
 
 .file-list div.d-flex div:last-child {
-  padding-right: 0.8rem;
+  padding-right: 0.75rem;
   flex-basis: 0;
   flex-grow: 1;
 }
@@ -146,6 +156,12 @@ ul.breadcrumbs li a:link, ul.breadcrumbs li a:visited {
 }
 
 @media (max-width: 655px) {
+  .header {
+    padding: 0 1rem;
+  }
+  .file-list {
+    font-size: .9375rem;
+  }
   .file-list div.d-flex {
     display: block;
   }
@@ -153,17 +169,32 @@ ul.breadcrumbs li a:link, ul.breadcrumbs li a:visited {
     max-width: 100%;
     word-break: break-all;
     white-space: normal;
+    vertical-align: top;
   }
   .file-list div.d-flex #size-header {
     display: none;
   }
   .file-list div.d-flex div:last-child {
-    padding-left: 3.5rem;
-    font-size: 0.85rem;
+    padding-left: 3.75rem;
+    font-size: 0.75rem;
     padding-top: 0;
+    margin-top: -.5rem;
+    color: #666;
+  }
+  .d-flex .row div:first-of-type {
+    padding-bottom: 0;
   }
+}
+
+@media (max-width: 500px) {
   header .information {
-    padding: 1rem 0;
+    width: 100%;
+    align-items: end;
+  }
+
+  .file-list div.d-flex div {
+    white-space: nowrap;
+    padding: .625rem 1rem;
   }
 }