Refactor Tor process handling and use control port

[molnard]

Is your feature request related to a problem?

Tor process handling was written in the early stages of the software. Since then a lot of stuff happened and it is time to revisit Tor handling and what can be done with the control port.

Concept of steps

• Execute Tor from the installation directory instead of copying it to datadir. Similarly like we do with hwi and bitcoind. Tor data-folder handled like before.

• Use custom ports, Wasabi should always run it's own Tor instance.

• Use the control port to ask the Tor instance to quit.

• Unleash the power of the control port, make optimizations if possible, like checking Tor status on control port instead of trying to figure out the problem by checking exceptions in WasabiSynchronizer.

[kiminuo]

Approach ACK.

I'm not sure about details, like:

Execute Tor from the installation directory instead of copying it to datadir.

Do you have writing permission there? I'm not sure probably yes, but it needs to be checked.

Use custom ports, Wasabi should always run it's own Tor instance.

Using own Tor is good to make implementation & testing easier. Not sure whether it has downsides. @lontivero and @nopara73 may probably know more about this subject.

[molnard]

Approach ACK.

I'm not sure about details, like:

Execute Tor from the installation directory instead of copying it to datadir.

Do you have writing permission there? I'm not sure probably yes, but it needs to be checked.

The installer put the files there similarly like with hwi and bitcoind. From Wasabi we are not writing anything.

[nopara73]

Not sure whether it has downsides. @lontivero and @nopara73 may probably know more about this subject.

It adds an extra Tor layer on torified OSs like Tails or Whonix. Nothing biggie.

[molnard]

@kiminuo can you take this from here?

[kiminuo]

Yes.

[molnard]

Sources to research:

• Bitcoin Core Tor handling code
• Wasabi PayJoin implementation here
• https://github.com/lontivero/Torino
• https://github.com/nopara73/DotNetTor/

[lontivero]

In this PR you can find a naive payjoin receiver implementation where I controlled Tor using the tor control port in order to create hidden services on the fly.

---

About Torino, it allows to create/list/destroy hidden services, listen for all kind of events, measure the bandwidth used by circuit/stream/total, stop/pause tor, get info tor (version, PID, user, auth method, etc), reload configuration, change/save configuration, change the guards among other things. It doesn't support cookie authentication (the one we should use) but I think it is a two lines of code change.

---

Use the control port to ask the Tor instance to quit.

This is not necessary because Tor will close automatically once the connection with the tor control port is closed. This is a very clever design and it is the behavior by default.

[PulpCattel]

@nopara73

It adds an extra Tor layer on torified OSs like Tails or Whonix. Nothing biggie.

Tor over Tor is discouraged by both Tor and Whonix developers.

https://torproject.org/docs/faq.html.en#ChoosePathLength
https://whonix.org/wiki/DoNot#Allow_Tor_over_Tor_Scenarios

The TL;DR quotes:

We don't want to encourage people to use paths longer than this — it increases load on the network without (as far as we can tell) providing any more security.
[...]
Also, using paths longer than 3 could harm anonymity.

However, it is not guaranteed that the three additional hops received are different; the user could end up with the same hops, possibly in reverse or mixed order.
[...]
Therefore, Tor over Tor configurations are strongly discouraged.

A simple very bad example I can imagine is if, as sometimes happens, the onion service of the coordinator goes down and the clients start connecting to the clearnet site. In a Tor over Tor scenario a client could get his guard node also as exit node (the guard node of e.g., Whonix will turn out to be the same node used by Wasabi Tor as exit), which is kinda one of the worst possible thing for a Tor user.

There are not many users that use torified OSs, and Wasabi uses mostly onion services (which should alleviate some of the problems), but those users should have the option to opt-out and not use the Wasabi Tor instance.

[davidanthoff]

Use custom ports

I just took a bit of a look on how to do that, and my impression is that the "official" way to do this is as follows:

• Start tor with SocksPorts auto, ControlPort auto and ControlPortWriteToFile SOME_TEMP_PATH where SOME_TEMP_PATH is some temporary filename.
• Read the control port from the file that tor wrote to SOME_TEMP_PATH.
• Connect to the control port.
• Query tor for the SOCKS port via the control port command GETINFO.

The main benefit of this approach seems to be that one can't run into already used port issues ever because the ports to be used are not hard coded, but tor instead can always pick some ports that are free.

[nopara73]

We should not use external Tor anymore, that leaves room for a bunch of issues. If we do that, then we can easily have control port. If we'll want to keep supporting external Tor, then that's problematic.

[nopara73]

Also guys a few years ago I wrote a Tor control port implementation and even a CodeProject tutorial for it, feel free to check it out.

This is the Tor that eventually ended up in Wasabi.

[lontivero]

@davidanthoff yes, that's the way. In fact the process can be improved even a bit more:

• Start tor with SocksPort auto, ControlPort auto, CookieAuthentication 1 and ControlPortWriteToFile SOME_TEMP_PATH
• Read the control port from the file that tor wrote to SOME_TEMP_PATH.
• Connect to the control port.
• Query tor for the protocol info (authentication method & cookie file path) via the control port command GETINFO.
• Read the control cookie file from protocolInfo.
• Authenticate with it.

[kiminuo]

@davidanthoff Do you plan to work on this? If so maybe kiminuo@43bb42d contains some useful bits too.

[kiminuo]

btw: Does anyone know an answer for this: https://tor.stackexchange.com/questions/22342/how-to-correctly-read-the-control-port-when-tor-is-started-with-controlport-a/22380?

@davidanthoff friendly ping :)

[kiminuo]

@molnard Is there anything left to do or can we close it?

[davidanthoff]

Sorry for not responding, too much other stuff going on. I won't have the bandwidth to work on this.

[kiminuo]

Sorry for not responding, too much other stuff going on. I won't have the bandwidth to work on this.

No problem. Thanks for chiming in anyway!

I think this issue is solved now. Obviously, I have many ideas to improve it but the main task is done. Please re-open if I'm wrong.