onionshare_cli 2.6.5__tar.gz → 2.7__tar.gz

{onionshare_cli-2.6.5 → onionshare_cli-2.7}/PKG-INFO

@@ -1,29 +1,26 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.3
 Name: onionshare_cli
-Version: 2.6.5
-Summary: OnionShare lets you securely and anonymously send and receive files. It works by starting a web server, making it accessible as a Tor onion service, and generating an unguessable web address so others can download files from you, or upload files to you. It does _not_ require setting up a separate server or using a third party file-sharing service.
-License: GPLv3+
+Version: 2.7
+Summary: Securely and anonymously share files, host websites, and chat with friends using the Tor network
+License: GPL-3.0-or-later
+Keywords: onion,share,onionshare,tor,anonymous,web server
 Author: Micah Lee
 Author-email: micah@micahflee.com
+Maintainer: Micah Lee
+Maintainer-email: micah@micahflee.com
 Requires-Python: >=3.10,<4.0
-Classifier: Environment :: Web Environment
-Classifier: Framework :: Flask
-Classifier: Intended Audience :: End Users/Desktop
-Classifier: License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)
-Classifier: License :: Other/Proprietary License
-Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3.13
-Classifier: Programming Language :: Python :: 3.14
+Classifier: Framework :: Flask
 Classifier: Topic :: Communications :: File Sharing
 Classifier: Topic :: Security :: Cryptography
+Classifier: License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)
+Classifier: Intended Audience :: End Users/Desktop
+Classifier: Operating System :: OS Independent
+Classifier: Environment :: Web Environment
 Requires-Dist: cffi (>=2,<3)
 Requires-Dist: click
 Requires-Dist: colorama
-Requires-Dist: cython (>=3.0.2,<4.0.0)
+Requires-Dist: cython (>=3.0.2,<4.0)
 Requires-Dist: eventlet
 Requires-Dist: flask (==3.1.3)
 Requires-Dist: flask-compress (>=1.24,<2.0)
@@ -31,16 +28,19 @@ Requires-Dist: flask-socketio (>=5.6,<6.0)
 Requires-Dist: gevent (>=26.5.0,<27.0.0)
 Requires-Dist: gevent-websocket
 Requires-Dist: packaging (>=24)
-Requires-Dist: pkgconfig (>=1.6.0,<2.0.0)
+Requires-Dist: pkgconfig (>=1.6.0,<2.0)
 Requires-Dist: psutil
-Requires-Dist: pynacl (>=1.6.2,<2.0.0)
+Requires-Dist: pynacl (>=1.6.2,<2.0)
 Requires-Dist: pysocks
 Requires-Dist: qrcode (>=7.4.2,<8.0.0)
 Requires-Dist: requests[socks] (>=2.32.3)
-Requires-Dist: setuptools (>=80,<81)
+Requires-Dist: setuptools (>=83)
 Requires-Dist: stem (==1.8.1)
 Requires-Dist: unidecode
 Requires-Dist: urllib3 (>=2.7,<3.0)
 Requires-Dist: waitress (>=3.0.1,<4.0.0)
-Requires-Dist: werkzeug (==3.1.8)
-Requires-Dist: wheel (>=0.46.2,<0.47.0)
+Requires-Dist: werkzeug (==3.1.9)
+Requires-Dist: wheel (>=0.46.2,<1.0)
+Project-URL: Documentation, https://docs.onionshare.org/
+Project-URL: Homepage, https://onionshare.org
+Project-URL: Repository, https://github.com/onionshare/onionshare

{onionshare_cli-2.6.5 → onionshare_cli-2.7}/onionshare_cli/__init__.py

@@ -19,6 +19,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 """
 
 import os
+import signal
 import sys
 import time
 import argparse
@@ -42,6 +43,12 @@ def main(cwd=None):
     common = Common()
     common.display_banner()
 
+    # Allow SIGTERM (e.g. `kill`, systemd stop) to clean up like Ctrl-C does
+    def sigterm_handler(signum, frame):
+        raise KeyboardInterrupt
+
+    signal.signal(signal.SIGTERM, sigterm_handler)
+
     # OnionShare CLI in OSX needs to change current working directory (#132)
     if common.platform == "Darwin":
         if cwd:
@@ -159,6 +166,18 @@ def main(cwd=None):
         dest="disable_files",
         help="Receive files: Disable receiving files",
     )
+    parser.add_argument(
+        "--max-upload-size",
+        metavar="size",
+        default="0",
+        help="Receive files: Maximum size of an upload, e.g. 100mb (0 means no limit)",
+    )
+    parser.add_argument(
+        "--max-upload-size-total",
+        action="store_true",
+        dest="max_upload_size_total",
+        help="Receive files: Apply the maximum upload size to the entire service lifespan",
+    )
     # Website args
     parser.add_argument(
         "--disable_csp",
@@ -210,11 +229,24 @@ def main(cwd=None):
     webhook_url = args.webhook_url
     disable_text = args.disable_text
     disable_files = args.disable_files
+    max_upload_size_raw = args.max_upload_size
+    max_upload_size_total = args.max_upload_size_total
     disable_csp = bool(args.disable_csp)
     custom_csp = args.custom_csp
     log_filenames = bool(args.log_filenames)
     verbose = bool(args.verbose)
 
+    # Parse the maximum upload size, which is given in human friendly units
+    try:
+        max_upload_size = common.parse_human_readable_filesize(max_upload_size_raw)
+    except ValueError:
+        print(f"Invalid maximum upload size: {max_upload_size_raw}")
+        sys.exit()
+
+    if max_upload_size_total and max_upload_size <= 0:
+        print("You must set --max-upload-size to use --max-upload-size-total")
+        sys.exit()
+
     # Verbose mode?
     common.verbose = verbose
 
@@ -259,6 +291,8 @@ def main(cwd=None):
                 mode_settings.set("receive", "webhook_url", webhook_url)
             mode_settings.set("receive", "disable_text", disable_text)
             mode_settings.set("receive", "disable_files", disable_files)
+            mode_settings.set("receive", "max_upload_size", max_upload_size)
+            mode_settings.set("receive", "max_upload_size_total", max_upload_size_total)
         if mode == "website":
             if disable_csp and custom_csp:
                 print(
@@ -451,7 +485,9 @@ def main(cwd=None):
             print("")
 
     # Start OnionShare http service in new thread
-    t = threading.Thread(target=web.start, args=(app.port,))
+    t = threading.Thread(
+        target=web.start, args=(app.port, app.unix_socket, app.unix_socket_dir)
+    )
     t.daemon = True
     t.start()
 

{onionshare_cli-2.6.5 → onionshare_cli-2.7}/onionshare_cli/censorship.py

@@ -144,7 +144,7 @@ class CensorshipCircumvention(object):
             )
             data = {"country": country}
         if transports:
-            data.append({"transports": transports})
+            data["transports"] = transports
         try:
             r = requests.post(
                 endpoint,

{onionshare_cli-2.6.5 → onionshare_cli-2.7}/onionshare_cli/common.py

@@ -17,8 +17,10 @@ GNU General Public License for more details.
 You should have received a copy of the GNU General Public License
 along with this program.  If not, see <http://www.gnu.org/licenses/>.
 """
+
 import base64
 import hashlib
+import importlib.metadata as importlib_metadata
 import importlib.resources as importlib_resources
 import os
 import platform
@@ -30,6 +32,7 @@ import threading
 import time
 import shutil
 import re
+import tempfile
 
 import colorama
 from colorama import Fore, Back, Style
@@ -59,8 +62,7 @@ class Common:
             self.platform = "BSD"
 
         # The current version of OnionShare
-        with open(self.get_resource_path("version.txt")) as f:
-            self.version = f.read().strip()
+        self.version = importlib_metadata.version(__package__)
 
     def display_banner(self):
         """
@@ -326,6 +328,7 @@ class Common:
             obfs4proxy_file_path = shutil.which("obfs4proxy")
             snowflake_file_path = shutil.which("snowflake-client")
             meek_client_file_path = shutil.which("meek-client")
+            webtunnel_file_path = shutil.which("webtunnel-client")
             prefix = os.path.dirname(os.path.dirname(tor_path))
             tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
             tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
@@ -352,6 +355,7 @@ class Common:
             obfs4proxy_file_path = os.path.join(base_path, "obfs4proxy.exe")
             snowflake_file_path = os.path.join(base_path, "snowflake-client.exe")
             meek_client_file_path = os.path.join(base_path, "meek-client.exe")
+            webtunnel_file_path = os.path.join(base_path, "webtunnel-client.exe")
             tor_geo_ip_file_path = os.path.join(base_path, "geoip")
             tor_geo_ipv6_file_path = os.path.join(base_path, "geoip6")
 
@@ -364,6 +368,7 @@ class Common:
                 obfs4proxy_file_path = os.path.join(base_path, "obfs4proxy")
                 snowflake_file_path = os.path.join(base_path, "snowflake-client")
                 meek_client_file_path = os.path.join(base_path, "meek-client")
+                webtunnel_file_path = os.path.join(base_path, "webtunnel-client")
                 tor_geo_ip_file_path = os.path.join(base_path, "geoip")
                 tor_geo_ipv6_file_path = os.path.join(base_path, "geoip6")
             else:
@@ -375,6 +380,7 @@ class Common:
                 obfs4proxy_file_path = shutil.which("obfs4proxy")
                 snowflake_file_path = shutil.which("snowflake-client")
                 meek_client_file_path = shutil.which("meek-client")
+                webtunnel_file_path = shutil.which("webtunnel-client")
                 prefix = os.path.dirname(os.path.dirname(tor_path))
                 tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
                 tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
@@ -386,6 +392,7 @@ class Common:
             obfs4proxy_file_path = "/usr/local/bin/obfs4proxy"
             snowflake_file_path = "/usr/local/bin/snowflake-client"
             meek_client_file_path = "/usr/local/bin/meek-client"
+            webtunnel_file_path = "/usr/local/bin/webtunnel-client"
 
         return (
             tor_path,
@@ -394,6 +401,7 @@ class Common:
             obfs4proxy_file_path,
             snowflake_file_path,
             meek_client_file_path,
+            webtunnel_file_path,
         )
 
     def build_data_dir(self):
@@ -430,12 +438,46 @@ class Common:
         os.makedirs(onionshare_data_dir, 0o700, True)
         return onionshare_data_dir
 
+    def build_cache_dir(self):
+        """
+        Returns the path of the OnionShare cache directory, which holds
+        non-essential data that can safely be deleted. On Linux and BSD this
+        follows the XDG Base Directory Specification (~/.cache/onionshare).
+        """
+        xdg_cache_home = os.environ.get("XDG_CACHE_HOME", "")
+        if not os.path.isabs(xdg_cache_home):
+            xdg_cache_home = os.path.expanduser("~/.cache")
+
+        onionshare_cache_dir = os.path.join(xdg_cache_home, "onionshare")
+
+        # Modify the cache dir if running tests
+        if getattr(sys, "onionshare_test_mode", False):
+            onionshare_cache_dir += "-testdata"
+
+        os.makedirs(onionshare_cache_dir, 0o700, True)
+        return onionshare_cache_dir
+
     def build_tmp_dir(self):
         """
         Returns path to a folder that can hold temporary files
         """
-        tmp_dir = os.path.join(self.build_data_dir(), "tmp")
-        os.makedirs(tmp_dir, 0o700, True)
+        if self.platform == "Darwin":
+            # macOS Application Support contains a space, which makes Unix
+            # socket targets unsuitable for Tor's ADD_ONION Port= argument.
+            # Keep all temporary files in the per-user system temp area.
+            dirname = "onionshare"
+            if getattr(sys, "onionshare_test_mode", False):
+                dirname += "-testdata"
+            tmp_dir = os.path.join(tempfile.gettempdir(), dirname)
+        else:
+            base_dir = (
+                self.build_data_dir()
+                if self.platform == "Windows"
+                else self.build_cache_dir()
+            )
+            tmp_dir = os.path.join(base_dir, "tmp")
+
+        os.makedirs(tmp_dir, mode=0o700, exist_ok=True)
         return tmp_dir
 
     def build_persistent_dir(self):
@@ -448,9 +490,16 @@ class Common:
 
     def build_tor_dir(self):
         """
-        Returns path to the tor data directory
+        Returns path to the tor data directory. The tor data directory holds
+        non-essential data that can safely be deleted, so on Linux and BSD
+        it lives under the XDG cache directory (~/.cache/onionshare).
         """
-        tor_dir = os.path.join(self.build_data_dir(), "tor_data")
+        if self.platform in ("Windows", "Darwin"):
+            base_dir = self.build_data_dir()
+        else:
+            base_dir = self.build_cache_dir()
+
+        tor_dir = os.path.join(base_dir, "tor_data")
         os.makedirs(tor_dir, 0o700, True)
         return tor_dir
 
@@ -496,11 +545,16 @@ class Common:
                 snowflake_pattern = re.compile(
                     r"(snowflake)(\s)+([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+)(\s)+([0-9A-Z]+)"
                 )
+                # WebTunnel bridge lines: "webtunnel <IP>:<port> <fingerprint> url=https://..."
+                webtunnel_pattern = re.compile(
+                    r"(webtunnel)(\s)+([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+)(\s)+([0-9A-Fa-f]+)(\s)+url=(.+)"
+                )
                 if (
                     ipv4_pattern.match(bridge)
                     or ipv6_pattern.match(bridge)
                     or meek_lite_pattern.match(bridge)
                     or snowflake_pattern.match(bridge)
+                    or webtunnel_pattern.match(bridge)
                 ):
                     valid_bridges.append(bridge)
         if valid_bridges:
@@ -533,20 +587,64 @@ class Common:
         return s[:output_len]
 
     @staticmethod
-    def human_readable_filesize(b):
+    def split_filesize(b):
         """
-        Returns filesize in a human readable format.
+        Splits a filesize into a human readable value and the index of its
+        unit, where 0 is bytes, 1 is KiB, 2 is MiB, and so on.
         """
         thresh = 1024.0
         if b < thresh:
-            return "{:.1f} B".format(b)
-        units = ("KiB", "MiB", "GiB", "TiB", "PiB", "EiB", "ZiB", "YiB")
-        u = 0
+            return b, 0
+        u = 1
         b /= thresh
         while b >= thresh:
             b /= thresh
             u += 1
-        return "{:.1f} {}".format(b, units[u])
+        return b, u
+
+    @staticmethod
+    def human_readable_filesize(b):
+        """
+        Returns filesize in a human readable format.
+        """
+        units = ("B", "KiB", "MiB", "GiB", "TiB", "PiB", "EiB", "ZiB", "YiB")
+        value, u = Common.split_filesize(b)
+        return "{:.1f} {}".format(value, units[u])
+
+    @staticmethod
+    def parse_human_readable_filesize(size_str):
+        """
+        Parse a human readable filesize such as "100mb", "1 GiB" or "512" into
+        an integer number of bytes. Uses base 1024, matching the KiB/MiB/GiB
+        units produced by human_readable_filesize(). A bare number is treated
+        as bytes. Raises ValueError if the string cannot be parsed.
+        """
+        match = re.match(r"^\s*([0-9]+(?:\.[0-9]+)?)\s*([a-zA-Z]*)\s*$", str(size_str))
+        if not match:
+            raise ValueError(f"Invalid filesize: {size_str}")
+
+        value = float(match.group(1))
+        unit = match.group(2).lower()
+        multipliers = {
+            "": 1,
+            "b": 1,
+            "k": 1024,
+            "kb": 1024,
+            "kib": 1024,
+            "m": 1024**2,
+            "mb": 1024**2,
+            "mib": 1024**2,
+            "g": 1024**3,
+            "gb": 1024**3,
+            "gib": 1024**3,
+            "t": 1024**4,
+            "tb": 1024**4,
+            "tib": 1024**4,
+        }
+        if unit not in multipliers:
+            raise ValueError(f"Unknown filesize unit: {unit}")
+
+        return int(value * multipliers[unit])
 
     @staticmethod
     def format_seconds(seconds):

{onionshare_cli-2.6.5 → onionshare_cli-2.7}/onionshare_cli/meek.py

@@ -48,9 +48,15 @@ class Meek(object):
             self.obfs4proxy_file_path,
             self.snowflake_file_path,
             self.meek_client_file_path,
+            self.webtunnel_file_path,
         ) = get_tor_paths()
 
         self.meek_proxies = {}
+        # The moat reflector, reached via domain fronting, that relays
+        # HTTPS requests to bridges.torproject.org. This is distinct from
+        # the CDN77 meek used as a built-in bridge, which only relays
+        # traffic to a Tor bridge and cannot serve the Moat API.
+        # https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/f6c72cec392f215a77a2aaed626bfcc53e030327
         self.meek_url = "https://1723079976.rsc.cdn77.org/"
         self.meek_front = "www.phpmyadmin.net"
         self.meek_env = {
@@ -118,7 +124,7 @@ class Meek(object):
         for line in iter(self.meek_proc.stdout.readline, b""):
             if "CMETHOD meek socks5" in line:
                 self.meek_host = line.split(" ")[3].split(":")[0]
-                self.meek_port = line.split(" ")[3].split(":")[1]
+                self.meek_port = line.split(" ")[3].split(":")[1].strip()
                 self.common.log(
                     "Meek",
                     "start",

{onionshare_cli-2.6.5 → onionshare_cli-2.7}/onionshare_cli/mode_settings.py

@@ -43,7 +43,7 @@ class ModeSettings:
             "persistent": {
                 "mode": None,
                 "enabled": False,
-                "autostart_on_launch": False
+                "autostart_on_launch": False,
             },
             "general": {
                 "title": None,
@@ -63,13 +63,24 @@ class ModeSettings:
                 "webhook_url": None,
                 "disable_text": False,
                 "disable_files": False,
+                # Maximum size of a single upload request, in bytes. 0 means no
+                # limit.
+                "max_upload_size": 0,
+                # If True, apply max_upload_size to the service's entire
+                # lifespan: once total_upload_size reaches max_upload_size, no
+                # further uploads are accepted.
+                "max_upload_size_total": False,
+                # Running total of bytes received by the service, persisted so
+                # the lifespan limit survives restarts of a persistent service.
+                "total_upload_size": 0,
             },
             "website": {
                 "disable_csp": False,
                 "custom_csp": None,
                 "log_filenames": False,
-                "filenames": []
+                "filenames": [],
             },
+            "download": {"data_dir": self.build_default_receive_data_dir(), "poll": 0},
             "chat": {},
         }
         self._settings = {}

{onionshare_cli-2.6.5 → onionshare_cli-2.7}/onionshare_cli/onion.py

@@ -159,6 +159,7 @@ class Onion(object):
             self.obfs4proxy_file_path,
             self.snowflake_file_path,
             self.meek_client_file_path,
+            self.webtunnel_file_path,
         ) = get_tor_paths()
 
         # The tor process
@@ -190,6 +191,23 @@ class Onion(object):
         s = key_b32.decode("utf-8")
         return s
 
+    def private_key_to_b64(self, encoded_key):
+        """
+        Converts a base32 encoded string back to a base64 encoded string.
+
+        This is used for adding a Private Key to an onion when operating in
+        client mode (such as when downloading from another OnionShare)
+        """
+        # Decode the base32 string into bytes
+        encoded_key_b32 = encoded_key.encode("utf-8")
+        decoded_bytes = base64.b32decode(encoded_key_b32 + b"====")
+
+        # Convert the decoded bytes to base64
+        base64_key = base64.b64encode(decoded_bytes)
+
+        # Convert to string and return
+        return base64_key.decode("utf-8")
+
     def connect(
         self,
         custom_settings=None,
@@ -316,6 +334,9 @@ class Onion(object):
             torrc_template = torrc_template.replace(
                 "{{snowflake_path}}", str(self.snowflake_file_path)
             )
+            torrc_template = torrc_template.replace(
+                "{{webtunnel_path}}", str(self.webtunnel_file_path)
+            )
 
             with open(self.tor_torrc, "w") as f:
                 self.common.log("Onion", "connect", "Writing torrc template file")
@@ -356,10 +377,10 @@ class Onion(object):
                                     )
                                 ) as o:
                                     f.write(o.read())
-                            elif builtin_bridge_type == "meek-azure":
+                            elif builtin_bridge_type == "meek":
                                 with open(
                                     self.common.get_resource_path(
-                                        "torrc_template-meek_lite_azure"
+                                        "torrc_template-meek"
                                     )
                                 ) as o:
                                     f.write(o.read())
@@ -370,6 +391,18 @@ class Onion(object):
                                     )
                                 ) as o:
                                     f.write(o.read())
+                            elif builtin_bridge_type == "webtunnel":
+                                # There are no built-in WebTunnel bridges:
+                                # BridgeDB only distributes WebTunnel bridges
+                                # via the Moat API. Requesting them here would
+                                # result in a torrc with UseBridges 1 and no
+                                # Bridge lines, which tor refuses to start.
+                                raise TorErrorInvalidSetting(
+                                    "There are no built-in WebTunnel bridges. "
+                                    "Request WebTunnel bridges from BridgeDB "
+                                    "using the 'Request a bridge' option, or "
+                                    "enter them as custom bridge lines."
+                                )
                             self.common.log(
                                 "Onion",
                                 "connect",
@@ -417,7 +450,11 @@ class Onion(object):
 
             return_code = self.tor_proc.poll()
             if return_code != None:
-                self.common.log("Onion", "connect", f"tor process has terminated early: {return_code}")
+                self.common.log(
+                    "Onion",
+                    "connect",
+                    f"tor process has terminated early: {return_code}",
+                )
 
             # Connect to the controller
             self.common.log("Onion", "connect", "authenticating to tor controller")
@@ -679,12 +716,45 @@ class Onion(object):
         else:
             return False
 
-    def start_onion_service(self, mode, mode_settings, port, await_publication):
+    def add_onion_client_auth(self, service_id, private_key, key_type="x25519"):
+        """
+        Implemented from scratch here because it never made it into Stem maint branch
+        """
+        if self.supports_v3_onions and self.supports_ephemeral:
+            private_key64 = self.private_key_to_b64(private_key)
+            request = f"ONION_CLIENT_AUTH_ADD {service_id} {key_type}:{private_key64}"
+            response = self.c.msg(request)
+            self.common.log("Onion", "add_onion_client_auth", response)
+            return response
+        else:
+            raise TorTooOldEphemeral()
+
+    def remove_onion_client_auth(self, service_id):
+        """
+        Implemented from scratch here because it never made it into Stem maint branch
+        """
+        if self.supports_v3_onions and self.supports_ephemeral:
+            request = f"ONION_CLIENT_AUTH_REMOVE {service_id}"
+            response = self.c.msg(request)
+            self.common.log("Onion", "remove_onion_client_auth", response)
+            return response
+        else:
+            raise TorTooOldEphemeral()
+
+    def start_onion_service(
+        self, mode, mode_settings, port, await_publication, unix_socket=None
+    ):
         """
         Start a onion service on port 80, pointing to the given port, and
         return the onion hostname.
         """
-        self.common.log("Onion", "start_onion_service", f"port={port}")
+        if unix_socket:
+            target = f"unix:{unix_socket}"
+        else:
+            target = port
+        self.common.log(
+            "Onion", "start_onion_service", f"port={port}, target={target}"
+        )
 
         if not self.supports_ephemeral:
             print(
@@ -736,7 +806,7 @@ class Onion(object):
         try:
             if not self.supports_stealth:
                 res = self.c.create_ephemeral_hidden_service(
-                    {80: port},
+                    {80: target},
                     await_publication=await_publication,
                     basic_auth=None,
                     key_type=key_type,
@@ -744,7 +814,7 @@ class Onion(object):
                 )
             else:
                 res = self.c.create_ephemeral_hidden_service(
-                    {80: port},
+                    {80: target},
                     await_publication=await_publication,
                     basic_auth=None,
                     key_type=key_type,