TODO:
Let anon-connection-wizard support different languages.
I am thinking about using https://github.com/Whonix/python-guimessages, but I am not sure if guimessages is the best way to do translations if we consider anon-connection-wizard as something that will finally be packaged into Debian.
I will investigate on the way to make anon-connection-wizard translatable. Do you any thoughts on this, @Patrick !
Thank you very much!
The API stuff… Perhaps such an API would be best merged into python-stem? What do you think? If it’s a fit, could you ask Damian please?
@iry what’s the remaining TODO to use anon-connection-wizard in Whonix 14?
I am really sorry for my late reply.
I think that’s all.
I will be working on these tasks later this week. 
Thank you very much for your suggestions, @Patrick!
I have written a draft of the proposal and I will send it out after polishing it.
Done:
https://github.com/Whonix/whonix-setup-wizard/pull/3
tor_status.py from whonix-setup-wizard package since an extended version of it is available in anon-connection-wizard package.Recent commits which includes:
whonix-setup-wizard
Problem is deb.torproject.org is dead.
Is this how you understand that ticket?
That kills torrc.d until Whonix will be based on Debian buster. (The one after stretch. Whonix 14 will be stretch based.)
Hi Patrick!
What Tor version does the Whonix decide to use in Whonix 14? Because it will help me to do the adjustment on whether supporting torrc.d in anon-connection-wizard or not.
BTW, it seems that not supporting torrc.d can be fairly easy, we can still use /etc/torrc.d/40_anon_connection_wizard.torrc and include this line in /etc/tor/torrc file:
%include /etc/torrc.d/40_anon_connection_wizard.torrc
We can even “support” torrc.d feature while using Tor LTS by including these lines in /etc/tor/torrc file:
%include /etc/torrc.d/30_whonix.torrc
%include /etc/torrc.d/40_anon_connection_wizard.torrc
%include /etc/torrc.d/50_user.torrc
Patrick Schleizer:
As is. No changes. The one from deb.torproject.org (stretch repository).
Thank you very much, Patrick!
Then the torrc.d is supported. Therefore both Anon-Connection-Wizard
and the integration to Whonix-Setup-Wizard are ready to be tested now.
Debian not having fixed their way forward with add torrc.d configuration directory is a major complication.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=866187
Will %include /etc/torrc.d/ go into /usr/share/tor/tor-service-defaults-torrc or /etc/tor/torrc? This is unanswered.
If we modify Whonix’s /etc/tor/torrc, users who upgrade will get an interactive dpkg conflict resolution dialog and will be confused, bridges users most likely breaking their connectivity if they install the new config file.
Since Upgrading Whonix 13 to Whonix 14 recommend apt-get-noninteractive dist-upgrade, the new /etc/tor/torrc by Whonix would overwrite bridges or otherwise user modified /etc/tor/torrc.
That is why /etc/tor/torrc hasn’t been modified in years.
Should upstream decide to go with /usr/share/tor/tor-service-defaults-torrc we would have to rewind our change and go through all of this again.
On other other hand if we add %include /etc/torrc.d/ to /usr/share/tor/tor-service-defaults-torrc and upstream later decides to go with /etc/tor/torrc we are parsing the config files in a different order, which could also lead to confusion.
Added anon-connection-wizard to https://github.com/Whonix/Whonix/tree/master/packages, build, and uploaded to Whonix (14) developers repository. But it’s not yet sorted to install it by default due to above issue mainly.
Hi Patrick!
Thank you so much for your detailed explanation. I agree with you that before sorting out how to support torrc.d feature, we should not:
/etc/tor/torrc)tor_status.py will be moved from whonix-setup-wizard to anon-connection-wizard )I have sent an email to Debian BTS to see if there is anything I can help with.
We will keep https://github.com/Whonix/whonix-setup-wizard indefinite since we need Whonix Repository GUI Tool (kdesudo whonix-setup-wizard repository).
(Unless we merge it into the https://github.com/Whonix/whonix-repository repository.)
(However, disclaimer can be abolished by next year. So all that will be left will be Whonix Repository GUI Tool and anon-connection-wizard.)
Qubes-Whonix 14.
Tor was already enabled without bridges (by whonix-setup-wizard).
sudo apt-get install anon-connection-wizard
kdesudo anon-connection-wizard
Next, next, next. Ended up with an empty page after the summary page.
Job for tor@default.service failed because the control process exited with error code.
See "systemctl status tor@default.service" and "journalctl -xe" for details.
Unexpected tor_status: cannot_connect
Could you please handle the error(s) better? On Unexpected tor_status: cannot_connect there should not be an empty page.
cat /etc/torrc.d/40_anon_connection_wizard.torrc
# This file is generated by and should ONLY be used by anon-connection-wizard.
# User's manual configuration should go to /etc/torrc.d/50_user.torrc, not here. Because:
# 1. This file can be easily overwritten by anon-connection-wizard.
# 2. Even a single character change in this file may cause error.
# However, deleting this file will be fine since a new plain file will be generated the next time you run anon-connection-wizard.
And Tor fails to start since config has only comments.
Dec 23 14:18:19 host tor[6768]: Dec 23 14:18:19.141 [warn] Error reading included configuration file or directory: "/etc/torrc.d".
Dec 23 14:18:19 host tor[6768]: Dec 23 14:18:19.141 [err] Reading config failed--see warnings above.
Dec 23 14:18:19 host systemd[1]: tor@default.service: Main process exited, code=exited, status=1/FAILURE
Dec 23 14:18:19 host systemd[1]: Failed to start Anonymizing overlay network for TCP.
Empty /etc/torrc.d/40_anon_connection_wizard.torrc is a anon-connection-wizard bug? But Tor refusing to start due to a config file with comments only is a Tor bug? Could you report that one please?
After deleting /etc/tor/torrc and /etc/torrc.d/40_anon_connection_wizard.torrc it did not work for me either. Same error.
Perhaps DisableNetwork 0 should always be inside /etc/torrc.d/40_anon_connection_wizard.torrc rather than /etc/tor/torrc?
Qubes 4.0-Whonix 14
I could not exactly reproduce the error. Same configuration.
The wizard is completing normally. However, after restarting sys-whonix (or more often rebooting, Qubes 4.0 being rather unstable), whonixcheck reports the following:
ERROR: Tor Config Check Result:
Your /etc/tor/torrc file contains at least one error.
(Tor exit code: 1)
Tor reports:
Dec 24 12:59:45.294 [notice] Tor 0.3.1.9 (git-df96a13e9155c7bf) running on Linux with Libevent 2.0.21-stable, OpenSSL 1.1.0f, Zlib 1.2.8, Liblzma 5.2.2, and Libzstd 1.1.2.
Dec 24 12:59:45.294 [notice] Tor can’t help you if you use it wrong! Learn how to be safe at Tor Project | Download
Dec 24 12:59:45.294 [notice] Read configuration file “/etc/tor/torrc”.
Dec 24 12:59:45.296 [warn] Error reading included configuration file or directory: “/etc/torrc.d”.
Dec 24 12:59:45.296 [err] Reading config failed–see warnings above.
Very likely because “/etc/torrc.d” does not exist.
I have yet to read the whole discussion about this %include line, and many other issues.
Thank you so much for your suggestion, Patrick!
Done:
Hi @Patrick !
I created a clean and latest proxy-vm from Whonix-14-gateway template, trying to reproduce the error, but failed. It seems @troubadour failed to reproduce it, too.
I doubt that the reason why Tor fails to starts is because “config has only comments”. I also doubt this is a anon-connection-wizard specific problem.
It works like this to get the error:
anon-connection-wizard uses tor_status.py ( the one in anon-connection-wizard package, not the one in whonox-setup-wizard package) to start Tor.
It will examine the exit codes of the following two commands and return cannot_connect when one of the exit code is not 0. Specifically:
command = 'systemctl --no-pager restart tor@default'
tor_status = call(command, shell=True)
if tor_status != 0:
return 'cannot_connect'
command = 'systemctl --no-pager status tor@default'
tor_status = call(command, shell=True)
if tor_status != 0:
return 'cannot_connect'
Would you please run the two commands in a shell to see what will happen?
I personally prefer the idea to only include “DisableNetwork 0” in /etc/tor/torrc. Because it will serve as a final switch indicating if Tor will be enabled or disabled. It does not make much sense when users have explicitly want to enable/disable Tor in anon-connection-wizard but fail because there is another out of date “DisableNetwork 0” line in another .torrc file which is not easy to find out.
What do you think?
Hi @troubadour ! I am really glad to see you back!!
Thank you so much for your testing!
Yes, the reason why /etc/torrc.d/ does not exist is because it is not persistent in a TemplateBasedVm in Qubes. I guess the solution is here:
I can definitely do a pull request to make /etc/torr.d persistent but:
torrc.d has not been set by upstream (Debian).How could condition elif self.tor_status == 'missing_disablenetwork_line': be triggered anyhow if we have repair_torrc?
Btw I suggest updating form Qubes testing repository for dom0 and templates. It fixed many issues for me related to VM startup bugs. And I keep starting VMs from command line. That works reliable. Start menu not so much.
It’s not as easy as adding binds+=( '/etc/torrc.d' ) to /usr/lib/qubes-bind-dirs.d/40_qubes-whonix.conf.