Skip to content

tornion 1.0.1 — security patch

Choose a tag to compare

View all tags
@LouisCourrian LouisCourrian released this 10 May 23:01
· 7 commits to main since this release
v1.0.1
531c421

🔒 Security patch. Following a static review pass, two real holes were closed.

Fixed

  • detect_running_tor() now actually verifies the SOCKS5 server is Tor. The previous probe accepted any SOCKS5-speaking endpoint, which would have let tornion silently route privacy-sensitive traffic through a non-Tor proxy (e.g. proxychains, dante, ssh -D) running on the default Tor ports. The probe now performs Tor's RESOLVE protocol extension (SOCKS5 command byte 0xF0); plain SOCKS5 servers reply with REP=0x07 ("Command not supported") and are rejected.

  • Hardened tar extraction for Python 3.9–3.11. install_tor() previously fell back to bare tarfile.extractall() when the filter="data" argument (3.12+) wasn't available, leaving a path-traversal window open if a malicious archive ever defeated the SHA-256 pin. New _safe_extract_tar() validates every member — rejects symlinks, hardlinks, devices, FIFOs, absolute paths, and any path that resolves outside the target directory — before calling extractall.

Changed

  • Reusing an externally-managed tor (use_existing=True, default) now logs a WARNING instead of INFO, telling the user explicitly that tornion did not start tor itself and pointing at use_existing=False for full management.
  • Per-HS tor-data cache subdirectory uses sha256(key_dir)[:16] instead of the builtin hash() (which is salted by PYTHONHASHSEED and produced a different name on every Python process, accumulating orphan cache directories). The on-disk .onion identity itself was never affected.

Internal

  • Docstring example for server.serve() corrected to the documented from tornion import server form.
  • Static "tests 21 passed" badge removed from the README (misleading — count had drifted).
  • README "Roadmap to 1.0" section renamed to "Roadmap" now that 1.0 has shipped.

Tests

34 unit tests + 1 e2e integration test (was 30 + 1). The 4 new ones guard against regression of the SOCKS5/RESOLVE probe and the tar extraction safety.

Upgrade

pip install --upgrade tornion

1.0.0 is being yanked from PyPI in favor of this release — existing installs continue to work, but new pip install tornion will skip it.

Assets 2
Loading