Hello everyone,
I'd like to announce Onionspray, a tool for setting up Onion Services for
existing public websites, working as a HTTPS rewriting proxy:
https://tpo.pages.torproject.net/onion-services/onionspray/
It's a fork of Alec Muffett's EOTK (https://github.com/alecmuffett/eotk), with
many enhancements but retaining compatibility, and relying on C Tor until an
alternative in Arti is available.
The first Onionspray version is 1.6.0, following the pre-existing version
sequence from EOTK.
Security fixes:
* This release fixes a CRITICAL security vulnerability related to
upstream HTTPS certificate verification, which is detailed at
https://tpo.pages.torproject.net/onion-services/onionspray/security/advisories/002-proxy_ssl_verify/
A related fix is also available for EOTK:
https://github.com/alecmuffett/eotk/pull/116
We urge Onionspray users that were testing the software while it was being on
it's early stages to upgrade ASAP to 1.6.0 and update their configurations, and
we recommend that EOTK to the same with the corresponding patch.
This issue might also affect other similar rewriting proxy setups,
and we urge operators to review and fix their Onion Service
configurations.
Main improvements over EOTK:
* MetricsPort support (for gathering metrics data from the tor instances).
* Denial of Service (DoS) protections.
* Circuit ID exporting to NGINX logs and optionally to the upstream
proxy (through the X-Onion-CircuitID HTTP header).
* Onionbalance v3 support ("softmaps" are working again).
* Revamped documentation.
* Installation procedures added for recent Debian and Ubuntu releases.
* Tor and OpenResty upgraded to the latest versions.
* Option to keep Onionspray running in the foreground (`--no-daemonize`).
* Local healthcheck action (`--health-local`), useful for containerized
execution.
The full ChangeLog is available at
https://tpo.pages.torproject.net/onion-services/onionspray/changelog/
For those wishing to switch from EOTK to Onionspray, there's a migration guide
at https://tpo.pages.torproject.net/onion-services/onionspray/migrating/
We also welcome people to report issues, send merge requests etc:
https://tpo.pages.torproject.net/onion-services/onionspray/contact/
And we have a bunch of issues waiting for contributions:
https://gitlab.torproject.org/tpo/onion-services/onionspray/-/issues
Finally, I'd like to thank Alec Muffett for his important work with EOTK
and for promoting Onion Services all these years :)
Thanks!
--
Silvio Rhatto
pronouns he/him
Attachment:
signature.asc
Description: PGP signature
_______________________________________________ tor-dev mailing list tor-dev@xxxxxxxxxxxxxxxxxxxx https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev