I2P Integration

goldstein-otg · October 2, 2018, 3:44pm

I forgot to push my last commit,should be fixed now (haven’t tested).

Added ntp setting and laptop mode(unrelated), please test again if you can

nurmagoz · October 2, 2018, 5:13pm

Yes its working!!!

I2P websites through TBB = works
Hexchat+I2P = works

2 Things strange:

i2p autostart doesnt work (you need to make it starting manually)
this message: (when you run “i2prouter start”)

The following link could not be opened. 
http://127.0.0.1:7657/ 
Please copy the link to the Workstation and open it there.
Use Tor Browser under Workstation to browse the internet. 
Debugging information: 
link_confirmation_vm_open_tool: qvm-open-in-vm 
input_object_stripped_and_trimmed: http://127.0.0.1:7657/ 
link_confirmation_vm_open_tool_output: Usage: /usr/bin/qvm-open-in-vm [--view-only] vmname filename 
link_confirmation_vm_open_tool_exit_code: 2

user@host:~$ sudo tail -f /var/log/i2p/wrapper.log
2018/10/02 16:42:43 |   at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
2018/10/02 16:42:43 |   at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
2018/10/02 16:42:43 |   at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
2018/10/02 16:42:43 |   at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
2018/10/02 16:42:43 |   at net.i2p.router.startup.LoadClientAppsJob$RunApp.run(LoadClientAppsJob.java:281)
2018/10/02 16:42:43 |   at java.lang.Thread.run(Thread.java:748)
2018/10/02 16:42:43 |   at net.i2p.util.I2PThread.run(I2PThread.java:103)
2018/10/02 16:42:43 | Caused by: java.lang.IllegalArgumentException: Bad RouterConsoleRunner arguments, check clientApp.0.args in your clients.config file! Usage: [[port host[,host]] [-s sslPort [host[,host]]] [webAppsDir]]
2018/10/02 16:42:43 |   at net.i2p.router.web.RouterConsoleRunner.<init>(RouterConsoleRunner.java:199)
2018/10/02 16:42:43 |   ... 7 more
^C
user@host:~$ sudo tail -f /var/log/i2p/log-router-0.txt
10/2/18 5:01:46 PM ^^^ 1 similar message omitted ^^^
10/2/18 5:03:45 PM ^^^ 1 similar message omitted ^^^
10/2/18 5:05:44 PM ^^^ 1 similar message omitted ^^^
10/2/18 5:07:44 PM ^^^ 1 similar message omitted ^^^
10/2/18 5:09:43 PM ^^^ 1 similar message omitted ^^^
10/2/18 5:11:42 PM ^^^ 1 similar message omitted ^^^                                                                                                                  
10/2/18 5:13:42 PM ^^^ 1 similar message omitted ^^^                                                                                                                  
10/2/18 5:15:41 PM ^^^ 1 similar message omitted ^^^                                                                                                                  
10/2/18 5:17:41 PM ERROR [leTimer2 3/4] p.router.transport.UPnPManager: UPnP start failed - port conflict?                                                            
10/2/18 5:19:40 PM ^^^ 1 similar message omitted ^^^                                                                                                                  
user@host:~$

goldstein-otg · October 2, 2018, 6:12pm

Great

Don’t run it with i2prouter start because it’s using other config files located in /user/home/.
Use sudo systemctl start i2p instead.
The autostart isn’t necessary because we will use a custom script to autostart it later.

Could you post the whole clientApp.0. part of your clients.config

I’ll have some time tomorrow to fix these issues.

Thanks for testing

nurmagoz · October 2, 2018, 6:36pm

i see , no problem.

sudo nano /var/lib/i2p/i2p-config/clients.config

# Modified by I2P User dir migration script
# NOTE: This I2P config file must use UTF-8 encoding
#
# If you have a 'split' directory installation, with configuration
# files in ~/.i2p (Linux), %APPDATA%\I2P (Windows),
# or /Users/(user)/Library/Application Support/i2p (Mac), be sure to
# edit the file in the configuration directory, NOT the install directory.
# When running as a Linux daemon, the configuration directory is /var/lib/i2p
# and the install directory is /usr/share/i2p .
# When running as a Windows service, the configuration directory is \ProgramData\i2p
# and the install directory is \Program Files\i2p .
#

# fire up the web console
## There are several choices, here are some examples:
## non-SSL, bind to local IPv4 only
#clientApp.0.args=7657 10.137.0.29 ./webapps/
## non-SSL, bind to local IPv6 only
#clientApp.0.args=7657 ::1 ./webapps/
## non-SSL, bind to all IPv4 addresses
#clientApp.0.args=7657 0.0.0.0 ./webapps/
## non-SSL, bind to all IPv6 addresses
#clientApp.0.args=7657 :: ./webapps/
## For SSL only, change clientApp.4.args below to https://
## SSL only
#clientApp.0.args=-s 7657 ::1,10.137.0.29 ./webapps/
## non-SSL and SSL
#clientApp.0.args=7657 ::1,127.0.0.1 . -s 7667 ::1,10.137.0.29 ./webapps/
## non-SSL only, both IPv6 and IPv4 local interfaces
clientApp.0.args=7657 ::1,127.0.0.1 . ./webapps/
clientApp.0.main=net.i2p.router.web.RouterConsoleRunner
clientApp.0.name=I2P Router Console
clientApp.0.onBoot=true
clientApp.0.startOnLoad=true

# SAM bridge
clientApp.1.main=net.i2p.sam.SAMBridge
clientApp.1.name=SAM application bridge
clientApp.1.args=sam.keys 10.137.0.29 7656 i2cp.tcp.host=10.137.0.29 i2cp.tcp.port=7654
clientApp.1.startOnLoad=false

# poke the i2ptunnels defined in i2ptunnel.config
clientApp.2.main=net.i2p.i2ptunnel.TunnelControllerGroup
clientApp.2.name=Application tunnels
clientApp.2.args=i2ptunnel.config
clientApp.2.delay=35
clientApp.2.startOnLoad=true

# run our own eepsite with a seperate jetty instance
clientApp.3.main=net.i2p.jetty.JettyStart
clientApp.3.name=I2P webserver (eepsite)
## To use the rewrite handler, edit jetty-rewrite.xml and use:
#clientApp.3.args="/path/to/jetty.xml" "/path/to/jetty-rewrite.xml"
## To use local SSL, edit jetty-ssl.xml and use:
#clientApp.3.args="/path/to/jetty.xml" "/path/to/jetty-ssl.xml"
## To use local or remote JMX, edit jetty-jmx.xml and use:
#clientApp.3.args="/path/to/jetty.xml" "/path/to/jetty-jmx.xml"
clientApp.3.args="/var/lib/i2p/i2p-config/eepsite/jetty.xml"
clientApp.3.delay=30
clientApp.3.startOnLoad=true

# load a browser pointing at the web console whenever we start up
clientApp.4.main=net.i2p.apps.systray.UrlLauncher
clientApp.4.name=Open Router Console in web browser at startup
clientApp.4.args=http://10.137.0.29:7657/
clientApp.4.delay=3
clientApp.4.startOnLoad=false

# BOB bridge
clientApp.5.args=
clientApp.5.delay=10
clientApp.5.main=net.i2p.BOB.BOB
clientApp.5.name=BOB application bridge
clientApp.5.startOnLoad=false

Anytime

Note: Forget to mention this I2Prouter installed from I2P offcial repos not from buster repos.

Patrick · October 2, 2018, 7:55pm

@nurmagoz:

The following link could not be opened. 
http://127.0.0.1:7657/ 
Please copy the link to the Workstation and open it there.
Use Tor Browser under Workstation to browse the internet. 
Debugging information: 
link_confirmation_vm_open_tool: qvm-open-in-vm 
input_object_stripped_and_trimmed: http://127.0.0.1:7657/ 
link_confirmation_vm_open_tool_output: Usage: /usr/bin/qvm-open-in-vm [--view-only] vmname filename 
link_confirmation_vm_open_tool_exit_code: 2

That is related to:

https://github.com/Whonix/open-link-confirmation/blob/master/usr/lib/open_link_confirmation

There is a minor bug here (no one triggered it yet since few people try
to click links from Qubes-Whonix-Gateway) which I just now fixed and
which will enter Whonix repository at some point:

However, that fix won’t do I2P Integration any good nor bad. It will
most likely results in changing from this error popup to “Link Confirm
Open does not support opening links on Gateway for security reasons. Use
Tor Browser under Workstation to browse the internet.” like it does in
Non-Qubes-Whonix-Gateway.

The TODO for I2P Integration here is, what results in calling in
open_link_confirmation being involved? I guess some startup script runs
http://127.0.0.1:7657/ or x-www-browser http://127.0.0.1:7657/ or so?

Do you plan to access http://127.0.0.1:7657/ from Whonix-Gateway or only
from Whonix-Workstation?

Depending on your plans, I am sure I could adjust
open-link-confirmation, adding support for some environment variable or so.

goldstein-otg · October 2, 2018, 8:43pm

It should look like this(i fixed that)
clientApp.0.args=7657 ::1,127.0.0.1 ./webapps/

@Patrick

The i2prouter script calls the browser, we don’t use this, so we don’t need to worry about these calls.

only the Gateway

7657 is the Router config page we don’t want the WS to have access to that.
I don’t plan on using open-link-confirmation

Patrick · October 3, 2018, 1:45pm

github.com/Kicksecure/tb-starter

Add i2p browser profile/launcher

Kicksecure:master ← eyedeekay:master

opened 08:41PM - 02 Oct 18 UTC

eyedeekay

+899 -36

This patch adds a way to automatically start a separate Tor Browser using a prof…ile designed for use with i2p instead of Tor. In order to do this, it was necessary to create a start-i2p-browser script based on the the start-tor-browser script, in order to create the .desktop files correctly, in order to change the --wm-class, and in order to pass a --profile directory to firefox. The start-i2p-browser script gets copied into the modified TBB directory, and the browser profile gets symlinked to the TBB profile data folder.

nurmagoz · October 3, 2018, 2:28pm

user@host:~$ sudo tail -f /var/log/i2p/log-router-0.txt
10/3/18 2:03:18 PM ^^^ 1 similar message omitted ^^^
10/3/18 2:05:18 PM ^^^ 1 similar message omitted ^^^                                                                                                                  
10/3/18 2:07:18 PM ^^^ 1 similar message omitted ^^^                                                                                                                  
10/3/18 2:09:18 PM ^^^ 1 similar message omitted ^^^                                                                                                                  
10/3/18 2:11:18 PM ^^^ 1 similar message omitted ^^^                                                                                                                  
10/3/18 2:13:18 PM ^^^ 1 similar message omitted ^^^                                                                                                                  
10/3/18 2:15:18 PM ^^^ 1 similar message omitted ^^^                                                                                                                  
10/3/18 2:17:18 PM ^^^ 1 similar message omitted ^^^
10/3/18 2:19:18 PM ^^^ 1 similar message omitted ^^^
10/3/18 2:21:18 PM ^^^ 1 similar message omitted ^^^
^C
user@host:~$ sudo tail -f /var/log/i2p/wrapper.log
2018/10/03 13:53:55 | 
2018/10/03 13:53:55 | Launching a JVM...
2018/10/03 13:53:56 | WrapperManager: Initializing...
2018/10/03 13:53:56 | Starting I2P 0.9.36-0-2ubuntu1-2ubuntu1
2018/10/03 13:53:56 | INFO: Native CPUID library jcpuid-x86-linux loaded from file
2018/10/03 13:53:57 | INFO: Locally optimized native BigInteger library loaded from file
2018/10/03 13:53:58 | Error loading the client app properties from /var/lib/i2p/i2p-config/clients.config java.io.FileNotFoundException: /var/lib/i2p/i2p-config/clients.config (Permission denied)
2018/10/03 13:53:58 | Warning - No client apps or router console configured - we are just a router
2018/10/03 13:54:06 | Warning: Unable to reach any of the NTP servers [0.us.pool.ntp.org, 1.us.pool.ntp.org, 2.us.pool.ntp.org, 0.north-america.pool.ntp.org, 1.north-america.pool.ntp.org, 2.north-america.pool.ntp.org, 0.pool.ntp.org, 1.pool.ntp.org, 2.pool.ntp.org] - network disconnected? Or set time.sntpServerList=myserver1.com,myserver2.com in advanced configuration.
2018/10/03 13:57:36 | CRIT  [uildExecutor] net.i2p.util.Clock            : Large clock shift backward by 70s
^C
user@host:~$

Patrick · October 8, 2018, 6:16am

Patrick · October 8, 2018, 6:18am

github.com/Kicksecure/open-link-confirmation

Labeling non-tor Browsers

Kicksecure:master ← eyedeekay:master

opened 05:19AM - 08 Oct 18 UTC

eyedeekay

+3 -2

So in tb-starter, I used $tb_title to set the name of the i2p browser to "i2p Br…owser" but in order for that string to be displayed open-link-confirmation needed to be made to use it. Previously I tried it a few different ways, but I think this one will work most consistently, but it changes the behavior of the script so that the automatically-determined name of the browser that is launched will only be used if $tb_title is unset.

Patrick · October 8, 2018, 2:33pm

All merged and all in Whonix testers repository.

nurmagoz · October 14, 2018, 5:19am

@goldstein-otg

this command has an error:

sudo sed -i "s/clientApp\.0\.args\=7657 \:\:1\,$GATEWAYIP/clientApp\.0\.args\=7657 \:\:1\,127\.0\.0\.1\./g" clients.config

it says:

sed: cant read clients.config: No such file or directory

goldstein-otg · October 14, 2018, 6:56am

sudo sed -i "s/clientApp\.0\.args\=7657 \:\:1\,$GATEWAYIP/clientApp\.0\.args\=7657 \:\:1\,127\.0\.0\.1\./g" /var/lib/i2p/i2p-config/clients.config

fixed

nurmagoz · October 14, 2018, 9:12am

@goldstein-otg this option

network.proxy.socks;         <--(blank)

will reback itself to the original string after off/on the appvm.

wonder if we can make TBB configurations permanent through console inside the template ?

nurmagoz · October 14, 2018, 10:41am

Things needs to be disabled/removed:

To be in the safe side , in order to stop the clearnet through I2P simply add as well the steps for removing these links:

false.i2p for 4444 , and outproxy-tor.meeh.i2p for 4445

Enable Upnp to open firewalls ports is still enabled in http://127.0.0.1:7657/confignet (maybe Upnp not functioning but its enabled in the console)
Disable susimail,susidns,i2psnark by default as its there is no possible way to run any atm (because all by default listening on port 7657, plus i2psnark issue cant be resolved unless its standalone or using transmission-i2p in ws) from http://127.0.0.1:7657/confignet
not sure about the jetty+eepsite thing if its going to work.

nurmagoz · October 14, 2018, 11:25am

Weird Stuff:- (needs investigation)

This is frequently happening , although i have done repeatedly the steps regarding privoxy:

Although there is green stars , but no hope to connect to .i2p from within the GW and/or WS

user@host:~$ sudo tail -f /var/log/i2p/wrapper.log
2018/10/14 09:45:06 | Unable to bind routerconsole to ::1 port 7657: java.io.IOException: IPv6 addresses unsupported
2018/10/14 09:45:06 | You may ignore this warning if the console is still available at http://localhost:7657
2018/10/14 09:45:06 | Unable to bind routerconsole to 127.0.0.1.127.0.0.1 port 7657: java.net.SocketException: Unresolved address
2018/10/14 09:45:06 | You may ignore this warning if the console is still available at http://localhost:7657
2018/10/14 09:45:06 | Unable to bind routerconsole to any address on port 7657
2018/10/14 10:49:38 | TERM trapped.  Shutting down.
2018/10/14 10:49:40 | CRIT  [r 1 shutdown] net.i2p.router.Router         : Shutting down the router...
2018/10/14 10:49:40 | CRIT  [r 1 shutdown] net.i2p.router.Router         : Starting final shutdown(3)
2018/10/14 10:49:40 | CRIT  [r 1 shutdown] net.i2p.router.Router         : Shutdown(3) complete
2018/10/14 10:49:40 | <-- Wrapper Stopped
^C
user@host:~$ sudo tail -f /var/log/i2p/log-router-0.txt
10/14/18 10:38:18 AM ^^^ 1 similar message omitted ^^^
10/14/18 10:40:18 AM ^^^ 1 similar message omitted ^^^
10/14/18 10:42:18 AM ^^^ 1 similar message omitted ^^^
10/14/18 10:44:18 AM ^^^ 1 similar message omitted ^^^
10/14/18 10:46:18 AM ERROR [leTimer2 4/4] p.router.transport.UPnPManager: UPnP start failed - port conflict?
10/14/18 10:48:18 AM ^^^ 1 similar message omitted ^^^                                                                                                                
10/14/18 10:50:18 AM ^^^ 1 similar message omitted ^^^                                                                                                                
10/14/18 10:50:57 AM CRIT  [r 1 shutdown] net.i2p.router.Router         : Shutting down the router...                                                                 
10/14/18 10:50:57 AM CRIT  [r 1 shutdown] net.i2p.router.Router         : Starting final shutdown(3)                                                                  
10/14/18 10:50:58 AM CRIT  [r 1 shutdown] net.i2p.router.Router         : Shutdown(3) complete                                                                        
^C                                                                                                                                                                    
user@host:~$ sudo tail -f /var/log/i2p/log-router-1.txt
10/14/18 9:22:23 AM WARN  [Timestamper ] .router.time.RouterTimestamper: Unable to reach any of the NTP servers [0.us.pool.ntp.org, 1.us.pool.ntp.org, 2.us.pool.ntp.org, 0.north-america.pool.ntp.org, 1.north-america.pool.ntp.org, 2.north-america.pool.ntp.org, 0.pool.ntp.org, 1.pool.ntp.org, 2.pool.ntp.org] - network disconnected? Or set time.sntpServerList=myserver1.com,myserver2.com in advanced configuration.
10/14/18 9:24:37 AM WARN  [P reader 1/4] rt.ntcp.OutboundEstablishState: NTP failure, NTCP adjusting clock by 111s
10/14/18 9:45:42 AM CRIT  [r 1 shutdown] net.i2p.router.Router         : Shutting down the router...
10/14/18 9:45:42 AM CRIT  [r 1 shutdown] net.i2p.router.Router         : Starting final shutdown(3)
10/14/18 9:45:43 AM CRIT  [r 1 shutdown] net.i2p.router.Router         : Shutdown(3) complete
^C
user@host:~$

goldstein-otg · October 14, 2018, 5:02pm

we can use update-i2pbrowser from the whonix testing repo now.

we already disabled Outproxies

Remove the outproxy from the tunnel on port 4444

sudo sed -i '/^.*tunnel\.0\.$proxyList\|option\.i2ptunnel\.httpclient\.SSLOutproxies$/d' "/var/lib/i2p/i2p-config/i2ptunnel.config"

Disable the https outproxy (port 4445)

sudo sed -i 's|^.*$tunnel\.6\.startOnLoad$.*|\1=false|' "/var/lib/i2p/i2p-config/i2ptunnel.config"

Couldn’t reproduce this, it’s disabled on my end.
Could you check your router.config for i2np.upnp.enable=false ?

DIsabled susimail, i2psnark and jetty. Don’t know about susidns needs to be tested.

try with i2pbrowser

Should be fixed now, please test again

Thanks for the input

goldstein-otg · October 15, 2018, 1:23pm

Please redact the first 12 lines of your router.config, this info should not be public.

I’ll remove this command, so this doesn’t happen again, i’m sorry for that.

This is weird, there is no ::1 in your config but it still tries.

Thats odd, i don’t see any errors that could lead to this. Have you tried to setup everything on a fresh VM ?

goldstein-otg · October 15, 2018, 2:52pm

@eyedeekay
Is there a reason for the missing noscript in the i2pbrowser ?

eyedeekay · October 15, 2018, 3:45pm

The embarassing one is that I installed it with make install and forgot to ‘git add usr/share/tb-profile-i2p/profile.i2p/extensions’, so they weren’t present in the git repo and I didn’t notice because they were .xpi files. I’ve already submitted a pull request to fix that. I’m mortified that I didn’t see that. I apologize. The other reason is that NoScript is now apparently a legacy extension in the TBB.