Skip to content

GitLab

  • Projects
  • Groups
  • Snippets
  • Help
    • Loading...
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in
T
Tor
  • Project overview
    • Project overview
    • Details
    • Activity
    • Releases
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 1,067
    • Issues 1,067
    • List
    • Boards
    • Labels
    • Service Desk
    • Milestones
  • Merge Requests 20
    • Merge Requests 20
  • CI / CD
    • CI / CD
    • Pipelines
    • Jobs
    • Schedules
  • Operations
    • Operations
    • Incidents
    • Environments
  • Analytics
    • Analytics
    • CI / CD
    • Repository
    • Value Stream
  • Members
    • Members
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar

GitLab is used only for code review, issue tracking and project management. Canonical locations for source code are still https://gitweb.torproject.org/ https://git.torproject.org/ and git-rw.torproject.org.

  • The Tor Project
  • Core
  • Tor
  • Issues
  • #15991

Closed
Open
Opened May 11, 2015 by donncha@donncha

Option to skip authorization verification in INTRODUCE2 cell

Tor clients include an authorization cookie in the INTRODUCE2 cell when accessing a hidden service configured with client authorization. The service verifies the INTRODUCE2 cells and denies request which don't include (a valid) authorization. I'd like to be able to use stealth authorization as a means of distributing introduction point information in a private way. I'd like for clients who eventually receive the decrypted introduction point data to be able to connect to the hidden service without needing to know the original authorization cookie.

This would be useful in my Summer of Privacy project to distribute IP data in a private way while allowing clients to connect as normal (without authorization) to a published descriptor containing those introduction points.

I can also see a use case situation where a service would like to distribute stealth authorization introduction points to a client outside of the HSDir system by using some other form of client authorization (web of trust, captcha, etc.).

I'd propose a 'HiddenServiceNoAuthorizationVerify' option to allow service operators to disable authorization verification of a per service basis. I think Tor should provide a suitable warning on start up to ensure operators are aware of the potential consequences of enabling the option.

HiddenServiceDir /var/lib/tor/hidden_service/
HiddenServicePort 80 127.0.0.1:80
HiddenServiceAuthorizeClient stealth user
HiddenServiceNoAuthorizationVerify 0

If people think this option is a reasonable idea, I can start writing a patch for the feature.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
None
Milestone
None
Assign milestone
Time tracking
None
Due date
None
Reference: tpo/core/tor#15991