Merge pull request 'Whonix installation and onion-grater profile' (#715) from nyxnor/cwtch-ui:whonix into trunk

Reviewed-on: #715
2023-09-06 17:47:45 +00:00 · 2023-09-06 17:47:45 +00:00 · 042b1287ff
parent e019f5f52d 88e405fdfe
commit 042b1287ff
2 changed files with 94 additions and 56 deletions
--- a/linux/cwtch-whonix.yml
+++ b/linux/cwtch-whonix.yml
@ -1,57 +1,73 @@
-# TODO: This can likely be restricted even further, especially in regards to the ADD_ONION pattern
+## Keep profiles in sync:
+## - https://git.openprivacy.ca/cwtch.im/cwtch-ui/src/branch/trunk/linux/cwtch-whonix.yml
+## - https://github.com/Whonix/onion-grater/blob/master/usr/share/doc/onion-grater-merger/examples/40_cwtch.yml
+
+---
 - exe-paths:
-  - ''
-users:
-  - '*'
-hosts:
-  - '*'
-commands:
-  AUTHCHALLENGE:
-    - 'SAFECOOKIE .*'
-  SETEVENTS:
-    - 'CIRC WARN ERR'
-    - 'CIRC ORCONN INFO NOTICE WARN ERR HS_DESC HS_DESC_CONTENT'
-  GETINFO:
-    - 'net/listeners/socks'
-    - '.*'
-  GETCONF:
-    - 'DisableNetwork'
-  SETCONF:
-    - 'DisableNetwork.*'
-  ADD_ONION:
-    - '.*'
-  DEL_ONION:
-    - '.+'
-  HSFETCH:
-    - '.+'
-events:
-  CIRC:
-    suppress: true
-  ORCONN:
-    suppress: true
-  INFO:
-    suppress: true
-  NOTICE:
-    suppress: true
-  WARN:
-    suppress: true
-  ERR:
-    suppress: true
-  HS_DESC:
-    response:
-      - pattern:     '650 HS_DESC CREATED (\S+) (\S+) (\S+) \S+ (.+)'
-      replacement: '650 HS_DESC CREATED {} {} {} redacted {}'
-      - pattern:     '650 HS_DESC UPLOAD (\S+) (\S+) .*'
-      replacement: '650 HS_DESC UPLOAD {} {} redacted redacted'
-      - pattern:     '650 HS_DESC UPLOADED (\S+) (\S+) .+'
-      replacement: '650 HS_DESC UPLOADED {} {} redacted'
-      - pattern:     '650 HS_DESC REQUESTED (\S+) NO_AUTH'
-      replacement: '650 HS_DESC REQUESTED {} NO_AUTH'
-      - pattern:     '650 HS_DESC REQUESTED (\S+) NO_AUTH \S+ \S+'
-      replacement: '650 HS_DESC REQUESTED {} NO_AUTH redacted redacted'
-      - pattern:     '650 HS_DESC RECEIVED (\S+) NO_AUTH \S+ \S+'
-      replacement: '650 HS_DESC RECEIVED {} NO_AUTH redacted redacted'
-      - pattern:     '.*'
-      replacement: ''
-  HS_DESC_CONTENT:
-    suppress: true
+    - '*'
+  users:
+    - '*'
+  hosts:
+    - '*'
+  commands:
+    SETEVENTS:
+      - 'CIRC WARN ERR'
+      - 'CIRC ORCONN INFO NOTICE WARN ERR HS_DESC HS_DESC_CONTENT'
+    GETINFO:
+      - pattern:       'network-liveness'
+        response:
+        - pattern:     '250-network-liveness=.*'
+          replacement: '250-network-liveness=up'
+      - pattern:       'status/bootstrap-phase'
+        response:
+        - pattern:     '250-status/bootstrap-phase=*'
+          replacement: '250-status/bootstrap-phase=NOTICE BOOTSTRAP PROGRESS=100 TAG=done SUMMARY="Done"'
+    GETCONF:
+      - pattern:       'DisableNetwork'
+        response:
+        - pattern:     '250 DisableNetwork=.*'
+          replacement: '250 DisableNetwork=0'
+    ADD_ONION:
+      ## {{{ Host: [::], Ports: 15000-15378
+      - pattern:     'ED25519-V3:(\S+) Flags=DiscardPK,Detach Port=9878,\[::\]:(15[0-2][0-9][0-9])'
+        replacement: 'ED25519-V3:{} Flags=DiscardPK,Detach Port=9878,{client-address}:{}'
+      - pattern:     'ED25519-V3:(\S+) Flags=DiscardPK,Detach Port=9878,\[::\]:(153[0-6][0-9])'
+        replacement: 'ED25519-V3:{} Flags=DiscardPK,Detach Port=9878,{client-address}:{}'
+      - pattern:     'ED25519-V3:(\S+) Flags=DiscardPK,Detach Port=9878,\[::\]:(1537[0-8])'
+        replacement: 'ED25519-V3:{} Flags=DiscardPK,Detach Port=9878,{client-address}:{}'
+      ## }}}
+    DEL_ONION:
+      - '.+'
+    HSFETCH:
+      - '.+'
+  events:
+    CIRC:
+      suppress: true
+    ORCONN:
+      suppress: true
+    INFO:
+      suppress: true
+    NOTICE:
+      suppress: true
+    WARN:
+      suppress: true
+    ERR:
+      suppress: true
+    HS_DESC:
+      response:
+        - pattern:     '650 HS_DESC CREATED (\S+) (\S+) (\S+) \S+ (.+)'
+          replacement: '650 HS_DESC CREATED {} {} {} redacted {}'
+        - pattern:     '650 HS_DESC UPLOAD (\S+) (\S+) .*'
+          replacement: '650 HS_DESC UPLOAD {} {} redacted redacted'
+        - pattern:     '650 HS_DESC UPLOADED (\S+) (\S+) .+'
+          replacement: '650 HS_DESC UPLOADED {} {} redacted'
+        - pattern:     '650 HS_DESC REQUESTED (\S+) NO_AUTH'
+          replacement: '650 HS_DESC REQUESTED {} NO_AUTH'
+        - pattern:     '650 HS_DESC REQUESTED (\S+) NO_AUTH \S+ \S+'
+          replacement: '650 HS_DESC REQUESTED {} NO_AUTH redacted redacted'
+        - pattern:     '650 HS_DESC RECEIVED (\S+) NO_AUTH \S+ \S+'
+          replacement: '650 HS_DESC RECEIVED {} NO_AUTH redacted redacted'
+        - pattern:     '.*'
+          replacement: ''
+    HS_DESC_CONTENT:
+      suppress: true
--- a/linux/install-whonix.sh
+++ b/linux/install-whonix.sh
@ -0,0 +1,22 @@
+#!/bin/sh
+set -eu
+
+INSTALL_PREFIX=$HOME/.local
+INSTALL_PREFIX=$INSTALL_PREFIX DESKTOP_PREFIX=$INSTALL_PREFIX ./install.sh
+
+# Open incoming ports
+echo "Opening Cwtch firewall for incoming traffic on ports 15000 to 15378"
+sudo mkdir -p /usr/local/etc/whonix_firewall.d
+echo "EXTERNAL_OPEN_PORTS+=\" \$(seq 15000 15378) \"" | \
+  sudo tee /usr/local/etc/whonix_firewall.d/40_cwtch.conf >/dev/null
+sudo whonix_firewall
+
+# Set launch options
+sed -i "s|env LD|env CWTCH_TAILS=true CWTCH_RESTRICT_PORTS=true CWTCH_BIND_EXTERNAL_WHONIX=true LD|" $INSTALL_PREFIX/bin/cwtch
+
+# Inform about steps to be done in the gateway
+echo "Complete installation in the Whonix-Gateway with the following command:"
+echo "  $ sudo onion-grater-add 40_cwtch"
+
+echo "Launch Cwtch in the Whonix-Workstation with:"
+echo "  $ $INSTALL_PREFIX/bin/cwtch"