test if Ricochet IM instructions are functional

phabricator-migrator · February 19, 2024, 5:47pm

Information

ID: 444
PHID: PHID-TASK-ve2v3fkrnup65ap7deag
Author: HulaHoop
Status at Migration Time: invalid
Priority at Migration Time: Normal

Description

Comments

HulaHoop

2016-04-03 19:14:42 UTC

Some major commits made to Ricochet recently. May affect CPFP whitelist:

Allow configuring external Tor in the environment

If the TOR_CONTROL_PORT environment variable is present, use that
external instance of Tor instead of launching a bundled one.

TOR_CONTROL_HOST and TOR_CONTROL_PASSWD are also available for the
control hostname and password respectively. These variables match
the names used by Tor Browser.

There is no need to configure the SOCKS address; Ricochet will discover
it automatically.

Allow configuring external Tor in the environment · ricochet-im/ricochet@fe8f24a · GitHub

Store identity keys in configuration when possible

For Tor >= 0.2.7, we can use ADD_ONION to configure hidden services, so
private keys no longer need to be in separate files on disk. When
possible, stop using those files and store keys only in our
configuration file.

Existing profiles will copy their keys into the configuration file, but
the old files will not be removed yet. Older versions of Tor remain
supported as well, and will always use the filesystem.

Store identity keys in configuration when possible · ricochet-im/ricochet@f8aeff2 · GitHub

Use the ADD_ONION command when Tor is new enough

For versions of Tor that support it, use ADD_ONION instead of SETCONF to
configure hidden services.

Use the ADD_ONION command when Tor is new enough · ricochet-im/ricochet@f38b266 · GitHub

Allow HiddenService to configure ephemeral services

Refactored the HiddenService class API to handle services that have no
filesystem representation.

Allow HiddenService to configure ephemeral services · ricochet-im/ricochet@4e2a97d · GitHub

HulaHoop

2016-06-04 21:47:42 UTC

Patrick

2017-01-10 18:02:35 UTC

Patrick

2017-01-10 22:10:51 UTC

Patrick

2017-01-17 05:40:24 UTC

Patrick

2017-02-02 23:12:50 UTC

Tibo

2018-04-19 21:38:16 UTC

Tibo

2018-04-23 20:52:22 UTC

So here are all the steps to make ricochet working :

Open Ricochet and close it (it will create all the config files and folders).
Then edit : $HOME/.local/share/Ricochet/ricochet.anondist-orig/ricochet.json :

{
    "identity": {
        "dataDirectory": "data-0",
        "localListenAddress": "10.152.152.11",
        "localListenPort": 12345
    },
    "tor": {
        "controlAddress": "127.0.0.1",
        "controlPort": 9151,
        "socksAddress": "127.0.0.1",
        "socksPort": 9050
    },
    "ui": {
        "combinedChatWindow": true,
        "language": "",
        "notificationVolume": 0.75
    }
}

Don’t forget to open the port 12345 on the workstation firewall.

On the gateway create the file /usr/local/etc/onion-grater-merger.d/40_ricochet.yml

---
- exe-paths:
    - '*'
  users:
    - '*'
  hosts:
    - '*'
  commands:
    GETINFO:
      - pattern: 'status/circuit-established status/bootstrap-phase'
        response:
        - pattern:     '250-status/circuit-established=*'
          replacement: '250-status/bootstrap-phase=NOTICE BOOTSTRAP PROGRESS=100 TAG=done SUMMARY="Done"'
    GETCONF:
      - 'DisableNetwork'
    ADD_ONION:
      - pattern:     'NEW:(\S+) Port=12345,\S+:(\S+)'
        replacement: 'NEW:{} Port=12345,{client-address}:{}'
      - pattern:     '(\S+):(\S+) Port=12345,\S+:(\S+)'
        replacement: '{}:{} Port=12345,{client-address}:{}'
    DEL_ONION:
      - '.+'
  events:
    STATUS_CLIENT:
      suppress: true

Edit torrc and create a new onion service :

HiddenServiceDir /var/lib/tor/ricochet/
HiddenServicePort 12345 10.152.152.11:12345
DisableNetwork 1

restart onion-grater and tor.
Ricochet should work now.

What’s after ?

Patrick

2018-04-24 08:28:43 UTC

Tibo (Tibo):

Tibo added a comment.

So here are all the steps to make ricochet working :

Open Ricochet and close it (it will create all the config files and folders).
Then edit : $HOME/.local/share/Ricochet/ricochet.anondist-orig/ricochet.json :

{
“identity”: {
“dataDirectory”: “data-0”,
“localListenAddress”: “10.152.152.11”,
“localListenPort”: 12345
},
“tor”: {
“controlAddress”: “127.0.0.1”,
“controlPort”: 9151,
“socksAddress”: “127.0.0.1”,
“socksPort”: 9050
},
“ui”: {
“combinedChatWindow”: true,
“language”: “”,
“notificationVolume”: 0.75
}
}

Probably a manual config is required because otherwise
localListenAddress is set to localhost.

Manual config is not how it is supposed to work. It worked before. This
means there could be a bug in #uwt and/or #bindp.

https://github.com/Whonix/uwt/blob/master/usr/lib/uwtwrapper (see
references to bindp)

uwt/usr/bin/ricochet.anondist at master · Whonix/uwt · GitHub

GitHub - Kicksecure/bindp: Binding specific IP and Port for Linux Running Application

Don’t forget to open the port 12345 on the workstation firewall.

On the gateway create the file
/usr/local/etc/onion-grater-merger.d/40_ricochet.yml

exe-paths:

‘*’
users:

‘*’
hosts:

‘*’
commands:
GETINFO:

pattern: ‘status/circuit-established status/bootstrap-phase’
response:

pattern: ‘250-status/circuit-established=*’
replacement: ‘250-status/bootstrap-phase=NOTICE BOOTSTRAP PROGRESS=100 TAG=done SUMMARY=“Done”’
GETCONF:

‘DisableNetwork’
ADD_ONION:

pattern: ‘NEW:(\S+) Port=12345,\S+:(\S+)’
replacement: ‘NEW:{} Port=12345,{client-address}:{}’

pattern: ‘(\S+):(\S+) Port=12345,\S+:(\S+)’
replacement: ‘{}:{} Port=12345,{client-address}:{}’
DEL_ONION:

‘.+’
events:
STATUS_CLIENT:
suppress: true

Edit torrc and create a new onion service :

HiddenServiceDir /var/lib/tor/ricochet/
HiddenServicePort 12345 10.152.152.11:12345
DisableNetwork 1

That should not be required because the onion service is supposed to be
an ephermal Tor onion services created by ricochet which is using Tor
control protocol ADD_ONION to do it (which then is actually talking to
#onion-grater).

What’s after ?

If you can fix this one, please fix this one.

Tibo

2018-04-25 23:10:51 UTC

Oh, my bad…

Probably a manual config is required because otherwise
localListenAddress is set to localhost.

Manual config is not how it is supposed to work. It worked before

Yes exactly, and also to set the localListenPort.
Sorry if my question is stupid but, is there a reason to use bindp instead of providing the configuration file ?

I notice that when i’m using bindp :

BIND_PORT=12345 BIND_ADDR="10.152.152.11" LD_PRELOAD=/usr/lib/libindp.so ricochet

I don’t see the ADD_ONION command on onion-grater logs and ricochet doesn’t work.

 10.152.152.11:53654 (filter: 30_autogenerated): -> PROTOCOLINFO 1
 10.152.152.11:53654 (filter: 30_autogenerated): <- 250-PROTOCOLINFO 1
 10.152.152.11:53654 (filter: 30_autogenerated): <- 250-AUTH METHODS=NULL
 10.152.152.11:53654 (filter: 30_autogenerated): <- 250-VERSION Tor="0.3.2.10 (git-0edaa32732ec8930)"
 10.152.152.11:53654 (filter: 30_autogenerated): <- 250 OK
 10.152.152.11:53654 (filter: 30_autogenerated): -> AUTHENTICATE
 10.152.152.11:53654 (filter: 30_autogenerated): <- 250 OK
 10.152.152.11:53654 (filter: 30_autogenerated): -> GETCONF DisableNetwork
 10.152.152.11:53654 (filter: 30_autogenerated): <- 250 DisableNetwork=0
 10.152.152.11:53654 (filter: 30_autogenerated): -> SETEVENTS STATUS_CLIENT
 10.152.152.11:53654 (filter: 30_autogenerated): subscribed to event 'STATUS_CLIENT'
 10.152.152.11:53654 (filter: 30_autogenerated): <- 250 OK
 10.152.152.11:53654 (filter: 30_autogenerated): -> GETINFO status/circuit-established status/bootstrap-phase net/listeners/socks
 10.152.152.11:53654 (filter: 30_autogenerated): rewrote response:
     250-status/circuit-established=1
     250-status/bootstrap-phase=NOTICE BOOTSTRAP PROGRESS=100 TAG=done SUMMARY="Done"
     250-net/listeners/socks="127.0.0.1:9050" "10.152.152.10:9050" "10.152.152.10:9100" "10.152.152.10:9101" "10.152.152.10:9102" "10.152.152.10:9103" "10.152.152.10:9104" "10.152.152.10:9105" "10.152.152.10:9106" "10.152.152.10:9107" "10.152.152.10:9108" "10.152.152.10:9109" "10.152.152.10:9110" "10.152.152.10:9111" "10.152.152.10:9112" "10.152.152.10:9113" "10.152.152.10:9114" "10.152.152.10:9115" "10.152.152.10:9116" "10.152.152.10:9117" "10.152.152.10:9118" "10.152.152.10:9119" "10.152.152.10:9120" "10.152.152.10:9121" "10.152.152.10:9122" "10.152.152.10:9123" "10.152.152.10:9124" "10.152.152.10:9125" "10.152.152.10:9150" "10.152.152.10:9152" "10.152.152.10:9153" "10.152.152.10:9154" "10.152.152.10:9155" "10.152.152.10:9156" "10.152.152.10:9157" "10.152.152.10:9158" "10.152.152.10:9159" "10.152.152.10:9160" "10.152.152.10:9161" "10.152.152.10:9162" "10.152.152.10:9163" "10.152.152.10:9164" "10.152.152.10:9165" "10.152.152.10:9166" "10.152.152.10:9167" "10.152.152.10:9168" "10.152.152.10:9169" "10.152.152.10:9170" "10.152.152.10:9171" "10.152.152.10:9172" "10.152.152.10:9173" "10.152.152.10:9174" "10.152.152.10:9175" "10.152.152.10:9176" "10.152.152.10:9177" "10.152.152.10:9178" "10.152.152.10:9179" "10.152.152.10:9180" "10.152.152.10:9181" "10.152.152.10:9182" "10.152.152.10:9183" "10.152.152.10:9184" "10.152.152.10:9185" "10.152.152.10:9186" "10.152.152.10:9187" "10.152.152.10:9188" "10.152.152.10:9189" "127.0.0.1:9100" "127.0.0.1:9101" "127.0.0.1:9102" "127.0.0.1:9103" "127.0.0.1:9104" "127.0.0.1:9105" "127.0.0.1:9106" "127.0.0.1:9107" "127.0.0.1:9108" "127.0.0.1:9109" "127.0.0.1:9110" "127.0.0.1:9111" "127.0.0.1:9112" "127.0.0.1:9113" "127.0.0.1:9114" "127.0.0.1:9115" "127.0.0.1:9116" "127.0.0.1:9117" "127.0.0.1:9118" "127.0.0.1:9119" "127.0.0.1:9120" "127.0.0.1:9121" "127.0.0.1:9122" "127.0.0.1:9123" "127.0.0.1:9124" "127.0.0.1:9125" "127.0.0.1:9150" "unix:/var/run/tor/socks"
     250 OK
 to:
     250-status/circuit-established=1
     250-status/bootstrap-phase=NOTICE BOOTSTRAP PROGRESS=100 TAG=done SUMMARY="Done"
     250-net/listeners/socks="127.0.0.1:9150"
     250 OK
 10.152.152.11:53654 (filter: 30_autogenerated): <- (multi-line)
     250-status/circuit-established=1
     250-status/bootstrap-phase=NOTICE BOOTSTRAP PROGRESS=100 TAG=done SUMMARY="Done"
     250-net/listeners/socks="127.0.0.1:9150"
     250 OK

However when I’m using the manual config to set the listening port and address I see the ADD_ONION command, and ricochet works:

10.152.152.11:53658 (filter: 30_autogenerated): -> PROTOCOLINFO 1
10.152.152.11:53658 (filter: 30_autogenerated): <- 250-PROTOCOLINFO 1
10.152.152.11:53658 (filter: 30_autogenerated): <- 250-AUTH METHODS=NULL
10.152.152.11:53658 (filter: 30_autogenerated): <- 250-VERSION Tor="0.3.2.10 (git-0edaa32732ec8930)"
10.152.152.11:53658 (filter: 30_autogenerated): <- 250 OK
10.152.152.11:53658 (filter: 30_autogenerated): -> AUTHENTICATE
10.152.152.11:53658 (filter: 30_autogenerated): <- 250 OK
 10.152.152.11:53658 (filter: 30_autogenerated): -> GETCONF DisableNetwork
 10.152.152.11:53658 (filter: 30_autogenerated): <- 250 DisableNetwork=0
 10.152.152.11:53658 (filter: 30_autogenerated): -> SETEVENTS STATUS_CLIENT
 10.152.152.11:53658 (filter: 30_autogenerated): subscribed to event 'STATUS_CLIENT'
 10.152.152.11:53658 (filter: 30_autogenerated): <- 250 OK
 10.152.152.11:53658 (filter: 30_autogenerated): -> GETINFO status/circuit-established status/bootstrap-phase
 10.152.152.11:53658 (filter: 30_autogenerated): <- (multi-line)
     250-status/circuit-established=1
     250-status/bootstrap-phase=NOTICE BOOTSTRAP PROGRESS=100 TAG=done SUMMARY="Done"
     250 OK
 10.152.152.11:53658 (filter: 30_autogenerated): -> ADD_ONION NEW:RSA1024 Port=9878,10.152.152.11:12345
 10.152.152.11:53658 (filter: 30_autogenerated): <- (multi-line)
     250-ServiceID=qnt5ga7x3ik3oucj
     250-PrivateKey=RSA1024:****
     250 OK

Patrick

2018-04-26 07:09:37 UTC

Tibo (Tibo):
Tibo added a comment.

Oh, my bad…
Probably a manual config is required because otherwise
localListenAddress is set to localhost.

Manual config is not how it is supposed to work. It worked before
Yes exactly, and also to set the localListenPort.
That is also supposed to be automatic.

Whatever ricochet chooses should work due to EXTERNAL_OPEN_ALL=true.
So uwt / bindp does not have to set BIND_PORT.

Sorry if my question is stupid but, is there a reason to use bindp instead of
providing the configuration file ?

Usability. Much shorter and easier instructions.

“Just start the application” vs “follow all of this”.

I notice that when i’m using bindp :

BIND_PORT=12345 BIND_ADDR=“10.152.152.11” LD_PRELOAD=/usr/lib/libindp.so ricochet

(This is good for testing however later needs to be done by uwt.)

https://github.com/Whonix/uwt/blob/master/usr/lib/uwtwrapper did not use
BIND_PORT. So probably doesn’t have to be invented.

What command uwtwrapper is actually executing to run bindp / ricochet?
Does that look sensible?

Tibo

2018-04-26 12:36:46 UTC

Patrick

2018-04-26 16:29:26 UTC

Tibo (Tibo):

Tibo added a comment.

I think I misunderstood something.

Yes.

I thought that the goal was to not use EXTERNAL_OPEN_ALL=true and just open one
port on the workstation firewall.

How did you get that idea?

EXTERNAL_OPEN_ALL=true is uncool indeed but at least instructions are
simple.

This ticket is in status “needs review”. Meaning, implementation is
done, but should be tested in next build.

This status is confusing and for ticket changes we’ll be using
testing-in-next-build-required as status.

This ticket is in status “needs review”. Meaning, implementation is
done, but should be tested in next build.

So the only remaining work here before you started working on this
ticket was:
Do the instructions in the wiki work as is? If yes, the ticket is done.

Sorry for the confusion!

I also thought that we can create the file
$HOME/.local/share/Ricochet/ricochet.anondist-orig/ricochet.json with the config
inside.
Exactly like the VLC config file I worked on.
So ricochet will be ready to use and the user will just have to open it.

I see.

However, then one still would have to modify Whonix-Gateway to create
the onion service. Resulting in ricochet in Whonix being more difficult
to set up than outside of Whonix. And very most users are deterred and
confused by a lot easier things already.

Tibo

2018-04-26 19:29:03 UTC

This ticket is in status “needs review”. Meaning, implementation is
done, but should be tested in next build.

This status is confusing and for ticket changes we’ll be using
testing-in-next-build-required as status.

This ticket is in status “needs review”. Meaning, implementation is

done, but should be tested in next build.

So the only remaining work here before you started working on this
ticket was:
Do the instructions in the wiki work as is? If yes, the ticket is done.

Thank you for the explanation ! It’s now much clearer.

I thought that the goal was to not use EXTERNAL_OPEN_ALL=true and just open one
port on the workstation firewall.

How did you get that idea?

EXTERNAL_OPEN_ALL=true is uncool indeed but at least instructions are
simple.

I got this idea with :

Problem is, ricochet picks a random high local port so we actually have to open all incoming workstation ports. Posted a feature request upstream:
Whonix compatibility & integration · Issue #30 · ricochet-im/ricochet · GitHub

It’s also useful so users don’t have to open all incoming ports in Whonix-Workstation firewall

But let’s start with the beginning :
I followed the instructions in the wiki, and it’s almost working.
The only thing missing is to set environment variable TOR_CONTROL_PORT=9151 and TOR_CONTROL_HOST="127.0.0.1".
That’s all :).

Patrick

2018-04-30 07:57:12 UTC

! In T444#15959, @Tibo wrote:
The only thing missing is to set environment variable TOR_CONTROL_PORT=9151 and TOR_CONTROL_HOST="127.0.0.1".
That’s all :).

Hm. Good catch.

Any idea why that is required?

TOR_CONTROL_HOST="127.0.0.1": Shouldn’t that be the default anyhow? Really doesn’t work without it?

TOR_CONTROL_PORT=9151: What does ricochet use by default? Port 9051? But that should work?

Could be a bug in #anon-ws-disable-stacked-tor Tor emulation.

We used to set these variables.

https://github.com/Whonix/anon-ws-disable-stacked-tor/blob/master/usr/lib/anon-ws-disable-stacked-tor/torbrowser.sh

But not anymore. Goals:

stick with the defaults as much as possible to cause as little as breakage as possible

maximum compatibility

Tor emulation on Whonix-Workstation so most applications are working

as few unneeded environment variables as possible

not confuse Tor Browser with global environment variables (uses IPC and in future only IPC. Other environment variables could leak to some bug which makes it fail to connect in future.)

You think this can be fixed in #anon-ws-disable-stacked-tor Tor emulation without setting a global environment variable?

Tibo

2018-04-30 17:57:07 UTC

Any idea why that is required?

Yes, ricochet is looking if a control port is defined in the config file or in the environment.
If a control port is defined, ricochet will not launch tor and will directly connect to the control host.

You think this can be fixed in anon-ws-disable-stacked-tor Tor emulation without setting a global environment variable?
Yes by creating the file etc/skel/.local/share/Ricochet/ricochet.anondist-orig/ricochet.json in anon-ws-disable-stacked-tor and specifying the control port inside it.

Another simple solution could be to edit the menu entry of ricochet to run it in a modified environment, which will not affect the global environment and not cause any breakage:
env TOR_CONTROL_PORT=9151 TOR_CONTROL_HOST="127.0.0.1" ricochet

At this point I don’t know what is the best solution.
What do you think ?

Patrick

2018-05-01 10:23:14 UTC

Tibo (Tibo):
Tibo added a comment.
Any idea why that is required?
Yes, ricochet is looking if a control port is defined in the config file or in
the environment.
If a control port is defined, ricochet will not launch tor and will directly
connect to the control host.
I see. So without these variables set, ricochet tries to to start its
own Tor client?

Is that startup prevented? (That is a goal of #anon-ws-disable-stacked-tor.)

And if it fails to start its own Tor client, ricochet will terminate? Or
not try to use any connections?

I guess the upstream bug in ricochet here is: “ricochet ignores
…IPC… variables”.
You think this can be fixed in anon-ws-disable-stacked-tor Tor emulation
without setting a global environment variable?
Yes by creating the file
etc/skel/.local/share/Ricochet/ricochet.anondist-orig/ricochet.json in
anon-ws-disable-stacked-tor and specifying the control port inside it.
(That would go into anon-apps-config package.)

I see. I want to avoid configs in home folders. These are a rabbit hole.

works for new builds

does not work for users who upgraded from earlier versions (unless we
invent a mechanism that might break)

hard to update in future (distribution changes vs upstream config changes)

Another simple solution could be to edit the menu entry of ricochet to run it in
a modified environment, which will not affect the global environment and not
cause any breakage:
env TOR_CONTROL_PORT=9151 TOR_CONTROL_HOST=“127.0.0.1” ricochet

uwt/usr/bin/ricochet.anondist at master · Whonix/uwt · GitHub

Add on top of export uwtwrapper_parent="${BASH_SOURCE[0]}"
TOR_CONTROL_PORT="9151"
TOR_CONTROL_HOST="127.0.0.1"
export TOR_CONTROL_PORT
export TOR_CONTROL_HOST
I think that place would be better. Then we don’t need to
config-package-dev displace another file and it also works from command
line.

(Working from start menu vs not working from command line would be
another strange bug that we would introduce by modifying the launcher.
Also then we’ll easily miss out on upstream launcher code changes.)

Tibo

2018-05-06 21:54:50 UTC

Patrick

2018-05-07 05:00:52 UTC

Patrick

2018-05-09 09:48:49 UTC

Patrick

2018-07-24 09:47:13 UTC

Patrick

2019-11-06 02:33:24 UTC