GNU bug report logs - #70341
[PATCH] gnu: Add support for pluggable transports to tor-service-type

Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.

Package: guix-patches; Reported by: Nigko Yerden <nigko.yerden@HIDDEN>; Keywords: patch; dated Thu, 11 Apr 2024 14:54:06 UTC; Maintainer for guix-patches is guix-patches@HIDDEN.

Message received at 70341 <at> debbugs.gnu.org:


Received: (at 70341) by debbugs.gnu.org; 10 May 2024 08:35:34 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Fri May 10 04:35:33 2024
Received: from localhost ([127.0.0.1]:41821 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1s5Lj3-0003gZ-0M
	for submit <at> debbugs.gnu.org; Fri, 10 May 2024 04:35:33 -0400
Received: from mail-lj1-f195.google.com ([209.85.208.195]:60789)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <nigko.yerden@HIDDEN>) id 1s5Lix-0003gI-OG
 for 70341 <at> debbugs.gnu.org; Fri, 10 May 2024 04:35:31 -0400
Received: by mail-lj1-f195.google.com with SMTP id
 38308e7fff4ca-2e0a0cc5e83so27351211fa.1
 for <70341 <at> debbugs.gnu.org>; Fri, 10 May 2024 01:35:28 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=gmail.com; s=20230601; t=1715330063; x=1715934863; darn=debbugs.gnu.org;
 h=content-transfer-encoding:mime-version:message-id:date:subject:cc
 :to:from:from:to:cc:subject:date:message-id:reply-to;
 bh=a/XxKLYfLTRZtD/+twN0ygtiWygE2upDzAySnFMBLM0=;
 b=i3Qq2BgqzjnTh576QIIkdJc4//HOgGJ+eMTK6tKvgd06QJPiybT5ge8NncNNPWPIpX
 8n253mESzAaBaeCg4yOJNEUgz7fuLp52azBm9ewugOvQW7H9zjsGXWjQvLBmJXcG+5Om
 iF9XmOP1+ODuWewRGIy8Tq/Ua9+RT2XnDn07z2SnF388KE/8QqC9g8EHZS0SQLayFsiE
 WdcXlc5ze30irjKDmpDG59YO38B9IoVh6LnpGHd9qb0voV20XrW3M9GICXjIAJwcb83W
 Zz6icouExoR74cCD8Xc9/2/HFj+2yKxqXVtDLKnzRuBRkyvnILMfsnCc3njMwGUCnhKk
 BH3A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1715330063; x=1715934863;
 h=content-transfer-encoding:mime-version:message-id:date:subject:cc
 :to:from:x-gm-message-state:from:to:cc:subject:date:message-id
 :reply-to;
 bh=a/XxKLYfLTRZtD/+twN0ygtiWygE2upDzAySnFMBLM0=;
 b=JeiSq2BcNR2A6qIVEPYlTMjCgP76jLxFXIqj1y1ej4qWn3LXCfOKMV1VOZXUe4coUX
 yhfYu1811nJ6kGZ/jOtjR8RFlDAr+gBGj/zztVfIFXZBK4szGs8FMW25iVtoaayGl7g/
 zv2FoPFauLNHyj/znJzAgUcgnsykDcLMdCtFEsrMEnaKQ94tG3y8MtzBCAXLhiwnj+wv
 A7iII1HwCVq2I9XuiJusbhacxTutxxEzU99f9xeGjGK9doPQ9pTbojWqp/aUWjy02dR+
 nYEwGgRgXF5UI4X0KyvntFHnr4D9XeUVRgwUcE1uv4awkVWh3sE+Wt8RMbu0vrbZcUqR
 Y26g==
X-Gm-Message-State: AOJu0Yws7UJeix5Lzy8eJwpM39p1sdRzZ/VtMCN6mUU/xEf8BzuaETK1
 Hy9W8WNGSWPnZtAvRhDA1XNfrUO27FTxyqxbjE8rCKbbQnsyfmsMO6uZF7Pq
X-Google-Smtp-Source: AGHT+IEB1GhAaNZ49ERrIZm2e2UXu37XpRB8zRPXIu8HF3Ef+iO6VEuMtaAPoqOx1ge/191bPRHhLA==
X-Received: by 2002:a2e:9355:0:b0:2dc:d2c5:ee9 with SMTP id
 38308e7fff4ca-2e51fe52115mr11000991fa.2.1715330062336; 
 Fri, 10 May 2024 01:34:22 -0700 (PDT)
Received: from localhost.localdomain ([62.33.150.148])
 by smtp.gmail.com with ESMTPSA id
 38308e7fff4ca-2e4d0bbcc28sm4369801fa.11.2024.05.10.01.34.21
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Fri, 10 May 2024 01:34:21 -0700 (PDT)
From: Nigko Yerden <nigko.yerden@HIDDEN>
To: 70341 <at> debbugs.gnu.org
Subject: [PATCH v4] services: tor: Add support for pluggable transports.
Date: Fri, 10 May 2024 13:32:02 +0500
Message-ID: <0983e0fb3aa290e1e0796c31c174bb2b7fdb615e.1715329922.git.nigko.yerden@HIDDEN>
X-Mailer: git-send-email 2.41.0
MIME-Version: 1.0
X-Debbugs-Cc: Florian Pelz <pelzflorian@HIDDEN>, Ludovic Courtès <ludo@HIDDEN>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 70341
Cc: Nigko Yerden <nigko.yerden@HIDDEN>
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Pluggable transports are programs that disguise Tor traffic, which
can be useful in case Tor is censored.  Pluggable transports
cannot be configured by #:config-file file exclusively because Tor
process is run via 'least-authority-wrapper' and cannot have access
to transport plugin, which is a separate executable (Bug#70302,
Bug#70332).

Example configuration snippet to be appended to
operation-system services
(see https://bridges.torproject.org/ to get
full bridge's lines):

(service tor-service-type
	 (tor-configuration
	  (config-file (plain-file "torrc"
				   "\
UseBridges 1
Bridge obfs4 ...
Bridge obfs4 ..."))
	  (transport-plugins
	   (list (tor-transport-plugin
		  (path-to-binary
		   (file-append
		    go-gitlab-torproject-org-tpo-anti-censorship-pluggable-transports-lyrebird
		    "/bin/lyrebird")))))))

* doc/guix.texi (Networking Services): Document 'tor-transport-plugin'
data type and 'transport-plugins' option for 'tor-configuration.
* gnu/services/networking.scm: Export
'tor-configuration-transport-plugins', 'tor-transport-plugin',
'tor-transport-plugin?', 'tor-transport-plugin-role',
'tor-transport-plugin-protocol', and 'tor-transport-plugin-path'.
(<tor-configuration>): Add 'transport-plugins' field.
(<tor-transport-plugin>): New variable.
(tor-configuration->torrc): Add content to 'torrc' computed-file.
(tor-shepherd-service): Add file-system-mapping(s).

Change-Id: I1b0319358778c7aee650bc843e021a6803a1cf3a
---
 doc/guix.texi               | 48 +++++++++++++++++++++++
 gnu/services/networking.scm | 76 +++++++++++++++++++++++++++++--------
 2 files changed, 108 insertions(+), 16 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index 1c1e0164e7..ae9bd7e290 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -127,6 +127,7 @@
 Copyright @copyright{} 2024 Herman Rimm@*
 Copyright @copyright{} 2024 Matthew Trzcinski@*
 Copyright @copyright{} 2024 Richard Sent@*
+Copyright @copyright{} 2024 Nigko Yerden@*
 
 Permission is granted to copy, distribute and/or modify this document
 under the terms of the GNU Free Documentation License, Version 1.3 or
@@ -21877,6 +21878,13 @@ Networking Services
 @file{/var/run/tor/control-sock}, which will be made writable by members of the
 @code{tor} group.
 
+@item @code{transport-plugins} (default: @code{'()})
+The list of @code{<tor-transport-plugin>} records to use.
+For any transport plugin you include in this list, appropriate
+configuration line to enable transport plugin will be automatically
+added to the default configuration file.
+
+
 @end table
 @end deftp
 
@@ -21905,6 +21913,46 @@ Networking Services
 @end table
 @end deftp
 
+@cindex pluggable transports, tor
+@deftp {Data Type} tor-transport-plugin
+Data type representing a Tor pluggable transport plugin in
+@code{tor-configuration}.  Plagguble transports are programs
+that disguise Tor traffic, which can be useful in case Tor is
+censored.  See the the Tor project's
+@url{https://tb-manual.torproject.org/circumvention/,
+documentation} and
+@url{https://spec.torproject.org/pt-spec/index.html,
+specification} for more information.
+
+Each transport plugin corresponds either to
+``ClientTransportPlugin ...'' or to
+``ServerTransportPlugin ...'' line in the default
+configuration file, see the @code{man tor}.
+Available @code{tor-transport-plugin} fields are:
+
+@table @asis
+@item @code{role} (default: @code{'client})
+This must be either @code{'client} or @code{'server}.  Otherwise,
+an error is raised.  Set the @code{'server} value if you want to
+run a bridge to help censored users connect to the Tor network, see
+@url{https://community.torproject.org/relay/setup/bridge/,
+the Tor project's brige guide}.  Set the @code{'client} value
+if you want to connect to somebody else's bridge, see
+@url{https://bridges.torproject.org/, the Tor project's
+``Get Bridges'' page}.  In both cases the required
+additional configuration should be provided via
+@code{#:config-file} option of @code{tor-configuration}.
+@item @code{protocol} (default: @code{"obfs4"})
+A string that specifies a pluggable transport protocol.
+@item @code{path-to-binary}
+This must be a ``file-like'' object or a string
+pointing to the pluggable transport plugin executable.
+This option allows the Tor daemon run inside the container
+to access the executable and all the references
+(e.g. package dependencies) attached to it.
+@end table
+@end deftp
+
 The @code{(gnu services rsync)} module provides the following services:
 
 You might want an rsync daemon if you have files that you want available
diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
index 8e64e529ab..cb1749ffe6 100644
--- a/gnu/services/networking.scm
+++ b/gnu/services/networking.scm
@@ -22,6 +22,7 @@
 ;;; Copyright © 2023 Declan Tsien <declantsien@HIDDEN>
 ;;; Copyright © 2023 Bruno Victal <mirai@HIDDEN>
 ;;; Copyright © 2023 muradm <mail@HIDDEN>
+;;; Copyright © 2024 Nigko Yerden <nigko.yerden@HIDDEN>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -159,10 +160,16 @@ (define-module (gnu services networking)
             tor-configuration-hidden-services
             tor-configuration-socks-socket-type
             tor-configuration-control-socket-path
+            tor-configuration-transport-plugins
             tor-onion-service-configuration
             tor-onion-service-configuration?
             tor-onion-service-configuration-name
             tor-onion-service-configuration-mapping
+	    tor-transport-plugin
+	    tor-transport-plugin?
+	    tor-transport-plugin-role
+	    tor-transport-plugin-protocol
+	    tor-transport-plugin-path
             tor-hidden-service  ; deprecated
             tor-service-type
 
@@ -955,7 +962,9 @@ (define-record-type* <tor-configuration>
   (socks-socket-type tor-configuration-socks-socket-type ; 'tcp or 'unix
                      (default 'tcp))
   (control-socket?  tor-configuration-control-socket-path
-                    (default #f)))
+                    (default #f))
+  (transport-plugins tor-configuration-transport-plugins
+                    (default '())))
 
 (define %tor-accounts
   ;; User account and groups for Tor.
@@ -985,10 +994,24 @@ (define-configuration/no-serialization tor-onion-service-configuration
 @end lisp
 maps ports 22 and 80 of the Onion Service to the local ports 22 and 8080."))
 
+(define-record-type* <tor-transport-plugin>
+  tor-transport-plugin make-tor-transport-plugin
+  tor-transport-plugin?
+  (role           tor-transport-plugin-role
+		  (default 'client)
+		  (sanitize (lambda (value)
+			      (if (memq value '(client server))
+				  value
+				  (configuration-field-error #f 'role value)))))
+  (protocol       tor-transport-plugin-protocol
+		  (default "obfs4"))
+  (path-to-binary tor-transport-plugin-path))
+
 (define (tor-configuration->torrc config)
   "Return a 'torrc' file for CONFIG."
   (match-record config <tor-configuration>
-    (tor config-file hidden-services socks-socket-type control-socket?)
+    (tor config-file hidden-services socks-socket-type control-socket?
+         transport-plugins)
     (computed-file
      "torrc"
      (with-imported-modules '((guix build utils))
@@ -1027,6 +1050,20 @@ (define (tor-configuration->torrc config)
                                     (cons name mapping)))
                                  hidden-services))
 
+               (for-each (match-lambda
+                           ((role-string protocol path)
+                            (format port "\
+~aTransportPlugin ~a exec ~a~%"
+                                    role-string protocol path)))
+                         '#$(map (match-lambda
+                                   (($ <tor-transport-plugin> role protocol path)
+                                    (list (if (eq? role 'client)
+                                              "Client"
+                                              "Server")
+                                          protocol
+                                          path)))
+                                 transport-plugins))
+
                (display "\
 ### End of automatically generated lines.\n\n" port)
 
@@ -1039,23 +1076,30 @@ (define (tor-configuration->torrc config)
 (define (tor-shepherd-service config)
   "Return a <shepherd-service> running Tor."
   (let* ((torrc (tor-configuration->torrc config))
+         (transport-plugins (tor-configuration-transport-plugins config))
          (tor   (least-authority-wrapper
                  (file-append (tor-configuration-tor config) "/bin/tor")
                  #:name "tor"
-                 #:mappings (list (file-system-mapping
-                                   (source "/var/lib/tor")
-                                   (target source)
-                                   (writable? #t))
-                                  (file-system-mapping
-                                   (source "/dev/log") ;for syslog
-                                   (target source))
-                                  (file-system-mapping
-                                   (source "/var/run/tor")
-                                   (target source)
-                                   (writable? #t))
-                                  (file-system-mapping
-                                   (source torrc)
-                                   (target source)))
+                 #:mappings (append
+                             (list (file-system-mapping
+                                    (source "/var/lib/tor")
+                                    (target source)
+                                    (writable? #t))
+                                   (file-system-mapping
+                                    (source "/dev/log") ;for syslog
+                                    (target source))
+                                   (file-system-mapping
+                                    (source "/var/run/tor")
+                                    (target source)
+                                    (writable? #t))
+                                   (file-system-mapping
+                                    (source torrc)
+                                    (target source)))
+                             (map (lambda (plugin)
+				    (file-system-mapping
+				     (source (tor-transport-plugin-path plugin))
+				     (target source)))
+				  transport-plugins))
                  #:namespaces (delq 'net %namespaces))))
     (list (shepherd-service
            (provision '(tor))

base-commit: 360fea15cb25d0cdf55ec55488956257a0219fe4
-- 
2.41.0





Information forwarded to pelzflorian@HIDDEN, ludo@HIDDEN, guix-patches@HIDDEN:
bug#70341; Package guix-patches. Full text available.

Message received at 70341 <at> debbugs.gnu.org:


Received: (at 70341) by debbugs.gnu.org; 30 Apr 2024 09:13:57 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Apr 30 05:13:57 2024
Received: from localhost ([127.0.0.1]:59260 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1s1jYi-00066j-OY
	for submit <at> debbugs.gnu.org; Tue, 30 Apr 2024 05:13:57 -0400
Received: from mail-lf1-x142.google.com ([2a00:1450:4864:20::142]:58490)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <nigko.yerden@HIDDEN>) id 1s1jYf-00066Z-Sb
 for 70341 <at> debbugs.gnu.org; Tue, 30 Apr 2024 05:13:55 -0400
Received: by mail-lf1-x142.google.com with SMTP id
 2adb3069b0e04-51ca95db667so5049722e87.0
 for <70341 <at> debbugs.gnu.org>; Tue, 30 Apr 2024 02:13:33 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=gmail.com; s=20230601; t=1714468406; x=1715073206; darn=debbugs.gnu.org;
 h=content-transfer-encoding:in-reply-to:content-language:references
 :cc:to:from:subject:user-agent:mime-version:date:message-id:from:to
 :cc:subject:date:message-id:reply-to;
 bh=HAH3OO75DNDOpJPG5hKHEneiWg+NI6QH72b+/r2YOb8=;
 b=e0u+4byUwMGrLQqD0GBEFNPRgEZQltPt3Si0YQ7RhotF/isbB126a8hBqHG7UTLhWR
 LGdgV1rEQk2AJGUMsv4XXKmYtZ8qGr/LUmVvk7Vc8wapBRCodqGIaCleMsMpnA8o4OZH
 G/txOyR+o6jpJazxj9NY6PSGFLdgI8rBhO/vVnx3Px3lB11BH5a4vAtNyOkw1vG1bslf
 U7ZV/rkuGuiNChUDD3/TcQcP/LPIT0P0aIwJ1Ap+KjorHo5Ns0NScZf3mrjlIagFy3fT
 FXPqFGlPycstY5R3BuF+LGRmNC47j1Th6eOfHhjwZJqryQx/WKpaamLiZBxkgK0j3PPn
 Ld/w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1714468406; x=1715073206;
 h=content-transfer-encoding:in-reply-to:content-language:references
 :cc:to:from:subject:user-agent:mime-version:date:message-id
 :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
 bh=HAH3OO75DNDOpJPG5hKHEneiWg+NI6QH72b+/r2YOb8=;
 b=P6NL2Ph+k8Oh7LweUV0ORvjbecCa+kLpgvr13UT9ammzDSKa3bHL6x6WkUWJGw9opG
 mvQoFxaX1ZirryNuYD2yLJdFUIhyg+FpAboZSq+5Zfkhs1P1kdCk3DLkYcP2anm91TxI
 VEYMJZ0AS8B8/fKvq3vMN4cSa3sOk6mjBC1MrwT1A7n3bW0ij+hlgkXL/LpKJh3PZ9Hf
 0xePCA02ErAE+rBrdSQB3/dogVXEy9PS7uDeJ2JGrlSkR014u4w0E7RU9HOOC7JqBpjT
 e1DNv8/IC8qpZDshut7bzfoYHNCNF6DzyGrbMxnf24qwrIIRNjtrpL0s/pWNS2LfwTz1
 KcOQ==
X-Gm-Message-State: AOJu0Yy2TByhTmsDKQdUQktabYpq4mV8TmeV/JGhDGAxVHRdIVWw2Dju
 lMXr+g4SQv4I8zRqInUaKdq3XhEhGPUnl3lNHZ1FTX4Abdg2y9WoIZ1eZJHV
X-Google-Smtp-Source: AGHT+IGldG+Hz+M9M+u8UbpLAJguXqojgZMFJe+wsaBEUytzZaF6uYj5gU/taSegupmkmEivUOQ0Ow==
X-Received: by 2002:a19:760f:0:b0:51b:7415:655f with SMTP id
 c15-20020a19760f000000b0051b7415655fmr9565828lff.36.1714468406037; 
 Tue, 30 Apr 2024 02:13:26 -0700 (PDT)
Received: from [127.0.0.1] ([188.68.138.94]) by smtp.gmail.com with ESMTPSA id
 y24-20020a197518000000b00518b91e8fd7sm4374411lfe.235.2024.04.30.02.13.25
 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);
 Tue, 30 Apr 2024 02:13:25 -0700 (PDT)
Message-ID: <bc45f503-9f49-4e5f-83fc-3072d44b5dc7@HIDDEN>
Date: Tue, 30 Apr 2024 14:13:24 +0500
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [bug#70341] [PATCH v3] services: tor: Add support for pluggable
 transports.
From: Nigko Yerden <nigko.yerden@HIDDEN>
To: =?UTF-8?Q?Andr=C3=A9_Batista?= <nandre@HIDDEN>
References: <11e72216f4be8b6559ecc04646fd722daa5dd09d.1712846897.git.nigko.yerden@HIDDEN>
 <3af678c4310a58373fe1e86b84f75a1d37e02295.1713758319.git.nigko.yerden@HIDDEN>
 <Zil1buljj2AfL2zL@andel> <f79869ab-8554-4ffe-aef2-a8e3f2632e84@HIDDEN>
Content-Language: en-US
In-Reply-To: <f79869ab-8554-4ffe-aef2-a8e3f2632e84@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 70341
Cc: 70341 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Hi André,

Here is some additional information about the patched tor-service-type 
which reveals:
1) Why it can fail if not properly configured.
2) Its internal workings which I find kind of cool.

First, it is not necessary to use PT-plugin from ready-to-go Guix 
package. It is possible to download PT-plugin source code and compile it 
directly, say, somewhere in $HOME folder. The corresponding 
configuration may look like this

(service tor-service-type
     (config-file (plain-file "torrc" ".... Bridge obfs4 ..."))
     (transport-plugin
        (local-file "/home/..../lyrebird"
                    #:recursive? #t)))

But this will not necessary work. The reason why it can fail is somewhat 
interesting. As we know, the tor process, thanks to the 
'least-authority-wrapper', is run inside a container, which, in 
particular, means it has very limited view of the file system. But 
PT-plugin executable is linked dynamically by default and has its 
dependency libraries inaccessible from within the container. However, if 
PT-plugin is linked statically, the configuration above will work.

Similarly, if PT-plugin is specified as a direct string path to the 
store item like this

(transport-plugin "/gnu/store/..../bin/lyrebird")

it may not work for the same reason.


However, if a file-like object is used instead like this

(transport-plugin (file-append PT-PACKAGE "/bin/lyrebird"))

all the dependencies of PT-PACKAGE are added automatically to the list 
of allowed paths inside the container (this is provided by the call to
'references-file' from inside 'least-authority-wrapper' procedure). As 
for me this means that the suggested patch fits very well to the guix'y 
way of doing things.


Regards,
Nigko




Information forwarded to guix-patches@HIDDEN:
bug#70341; Package guix-patches. Full text available.

Message received at 70341 <at> debbugs.gnu.org:


Received: (at 70341) by debbugs.gnu.org; 25 Apr 2024 06:09:25 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Thu Apr 25 02:09:25 2024
Received: from localhost ([127.0.0.1]:60394 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1rzsIO-0004CW-7B
	for submit <at> debbugs.gnu.org; Thu, 25 Apr 2024 02:09:25 -0400
Received: from mail-lj1-x234.google.com ([2a00:1450:4864:20::234]:53556)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <nigko.yerden@HIDDEN>) id 1rzsII-0004AD-5Q
 for 70341 <at> debbugs.gnu.org; Thu, 25 Apr 2024 02:09:22 -0400
Received: by mail-lj1-x234.google.com with SMTP id
 38308e7fff4ca-2db13ca0363so7909341fa.3
 for <70341 <at> debbugs.gnu.org>; Wed, 24 Apr 2024 23:09:00 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=gmail.com; s=20230601; t=1714025334; x=1714630134; darn=debbugs.gnu.org;
 h=content-transfer-encoding:in-reply-to:content-language:from
 :references:cc:to:subject:user-agent:mime-version:date:message-id
 :from:to:cc:subject:date:message-id:reply-to;
 bh=xLoy07RoOG9L3ZoODsULAyMnq+UKYHAcZoW9IoD8TMM=;
 b=Uow+LPIMzdyVbhe6ggmzsEP/xpRZyWT9nOlVFSb4V957aUl8sxlg3borukUc17f2S4
 dkv8x2GJDeXBb8TjtHnEwQPsSte+Bbv1BPSa6Bek/g+G2OI3SLrBZcUxGz/x96Usifd8
 Ejcv79Fxi9EO3DoLZoi6frl6aANckYshEObO3lndDHsxf5om2+i3X8IbLIly9Ajtu2Qf
 CSN7c59oKpGkF+Ey49NyEpDAbTu/dZCxlCsXB0vbtU4zj3ky6ImPvHVK8KhAbIFZcxba
 KW4TnRFWunBnuflcbXv0Grly5hNV0r3YNzvT3HU9GjANwlfcMfWFLW6CGZs+8Cc7nimK
 rwUQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1714025334; x=1714630134;
 h=content-transfer-encoding:in-reply-to:content-language:from
 :references:cc:to:subject:user-agent:mime-version:date:message-id
 :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
 bh=xLoy07RoOG9L3ZoODsULAyMnq+UKYHAcZoW9IoD8TMM=;
 b=Nne9aA9cfoHqSveuZqFfnhIDhpWWQV6dP1UO6pWuFn2i47WhI3U/u4dyWH4/TEZ/Wc
 gppZEwtLwJXXQ6vsBnLkD+Qz4CsbX83ab/bKhVdajDcxoCndr/JZzG1HLaX+DxfHUry/
 hmNl74KXx/yXahj4z4uz752v8pfA9feqU5V2db5dYCeTs1m4ISGjk9cLP/sFogHZboVV
 zSBFqDsMd2VxDgpRBzM3v8eRoc1XCBQ9Q5fgzhDOaTL/0hAncHqKPIzYyGw6pQR2pwmK
 v2OMu+LwMThxpTt4GaGlyngZZHhWmPDU9wnF5Z/dw40BpnTAy0kckNU/hanXtJoXhCcn
 Lfzw==
X-Gm-Message-State: AOJu0Yww4FNvfeRWPPgbaXHLaVA79lSXIAIgR7LF0dZCYII2Zrx05koQ
 84h06eEBVyi1uIQX2d+dlO/+lNc8OpAJyCUd7s7Pmi23W4V2Y11g
X-Google-Smtp-Source: AGHT+IG8ZGLJivVr4/VglHSciaE+B/Pb/x6/wQB0TlqlftvBm7S4/qziZ1AzOxqc0LMFKm8H2z6Igw==
X-Received: by 2002:a2e:a587:0:b0:2dd:7938:ed2f with SMTP id
 m7-20020a2ea587000000b002dd7938ed2fmr4521791ljp.19.1714025333996; 
 Wed, 24 Apr 2024 23:08:53 -0700 (PDT)
Received: from [127.0.0.1] ([212.75.155.102]) by smtp.gmail.com with ESMTPSA id
 j25-20020a2e6e19000000b002dd7615e1f7sm1189832ljc.95.2024.04.24.23.08.53
 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);
 Wed, 24 Apr 2024 23:08:53 -0700 (PDT)
Message-ID: <f79869ab-8554-4ffe-aef2-a8e3f2632e84@HIDDEN>
Date: Thu, 25 Apr 2024 11:08:52 +0500
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [bug#70341] [PATCH v3] services: tor: Add support for pluggable
 transports.
To: =?UTF-8?Q?Andr=C3=A9_Batista?= <nandre@HIDDEN>
References: <11e72216f4be8b6559ecc04646fd722daa5dd09d.1712846897.git.nigko.yerden@HIDDEN>
 <3af678c4310a58373fe1e86b84f75a1d37e02295.1713758319.git.nigko.yerden@HIDDEN>
 <Zil1buljj2AfL2zL@andel>
From: Nigko Yerden <nigko.yerden@HIDDEN>
Content-Language: en-US
In-Reply-To: <Zil1buljj2AfL2zL@andel>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 70341
Cc: 70341 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Hi André,

Thank you for the feedback!

> I can confirm that the tor service is unable to fork-exec a 
> pluggable-transport and the bootstrap process is halted at its start 
> when trying to use a system wide bridge + PT. However, this patch 
> does not seem to address the issue at hand, since it just creates new
> tor-service-type configuration options that accomplish the same as
> configuring on config-file directly. Have you had success with this?
> I had no luck.
Yes, I have! This patch not only creates new tor-service-type
configuration options but, which is crucial, adds pluggable transport
(PT) executable, if provided, to #:mappings argument of the
least-authority-wrapper, see 'tor-shepherd-service' chunk. With this
patch Tor process gets access to PT plugin and, if bridges are
configured via config-file field, Tor starts using obfuscated traffic.

> Even if it had succeeded though, I'm not sure if this is the best 
> approach to it, since it would break guix system configuration,
> right?
No, the patch does not break any existing tor-service-type
configuration. If PT is not used, 'transport-plugin' defaults to '#f',
and the Tor works exactly as if there wasn't any patch at all.

> How would one know beforehand which binary to point to? One would
> first need to install the PT and look to its path on store and then
> link to it in a new configuration. And then this link would have to
> be manualy updated. Am I missing something here?
There is much simpler and convenient way of doing this. If users want to 
bring PT into action, they may simply write

(service tor-service-type
	(config-file ".... Bridge obfs4 ...")
	(transport-plugin (file-append PT-PACKAGE "/bin/name-of-executable"))

The PT-PACKAGE does not even have to be present in the list of
'operating-system 'packages field, since Guix will find the reference to
PT-package and install it automatically. The only thing which should be
known beforehand is the "name-of-executable".
For
'go-gitlab-torproject-org-tpo-anti-censorship-pluggable-transports-lyrebird 
package it is "lyrebird", while for 
'go-github-com-operatorfoundation-obfs4 it is "obfs4proxy". It is
unlikely that these names will change with upgrades.

> Finally, next time, try to keep the issue to a single thread. I'm 
> replying to #70332 and #70302 just for reference, but let's keep to 
> #70341 going forward.
Sorry about that! I have tried not to create new bug issue but was
unsuccessful. Perhaps I shouldn't have touched the email heading.

Regards,
Nigko



André Batista wrote:
> Hi Nigko,
> 
> seg 22 abr 2024 às 08:58:39 (1713787119), nigko.yerden@HIDDEN
> enviou:
>> Pluggable transports are programs that disguise Tor traffic, which 
>> can be useful in case Tor is censored.  Pluggable transports cannot
>> be configured by #:config-file file exclusively because Tor process
>> is run via 'least-authority-wrapper' and cannot have access to
>> transport plugin, which is a separate executable (Bug#70302, 
>> Bug#70332).
> 
> I can confirm that the tor service is unable to fork-exec a 
> pluggable-transport and the bootstrap process is halted at its start 
> when trying to use a system wide bridge + PT. However, this patch 
> does not seem to address the issue at hand, since it just creates new
> tor-service-type configuration options that accomplish the same as
> configuring on config-file directly. Have you had success with this?
> I had no luck.
> 
> More comments bellow.
> 
>> * doc/guix.texi (Networking Services): Document 'transport-plugin'
>> and 'pluggable-transport' options for 'tor-configuration'. *
>> gnu/services/networking.scm: Export
>> 'tor-configuration-transport-plugin-path', 
>> 'tor-configuration-pluggable-transport'. (<tor-configuration>): Add
>> 'transport-plugin' and 'pluggable-transport' fields. 
>> (tor-configuration->torrc)[transport-plugin]: Add content to
>> 'torrc' computed-file. (tor-shepherd-service)[transport-plugin]:
>> Add file-system-mapping.
>> 
>> Change-Id: I64e7632729287ea0ab27818bb7322fddae43de48 --- 
>> doc/guix.texi               | 11 ++++++++ 
>> gnu/services/networking.scm | 54
>> ++++++++++++++++++++++++++----------- 2 files changed, 49
>> insertions(+), 16 deletions(-)
>> 
>> diff --git a/doc/guix.texi b/doc/guix.texi index
>> 65af136e61..eb0837860e 100644 --- a/doc/guix.texi +++
>> b/doc/guix.texi @@ -127,6 +127,7 @@ Copyright @copyright{} 2024
>> Herman Rimm@* Copyright @copyright{} 2024 Matthew Trzcinski@* 
>> Copyright @copyright{} 2024 Richard Sent@* +Copyright @copyright{}
>> 2024 Nigko Yerden@*
>> 
>> Permission is granted to copy, distribute and/or modify this
>> document under the terms of the GNU Free Documentation License,
>> Version 1.3 or @@ -21849,6 +21850,16 @@ Networking Services 
>> @file{/var/run/tor/control-sock}, which will be made writable by
>> members of the @code{tor} group.
>> 
>> +@item @code{transport-plugin} (default: @code{#f}) +This must be
>> either @code{#f} or a ``file-like'' object pointing to the 
>> +pluggable transport plugin executable.  In the latter case the 
>> +@code{#:config-file} file should contain line(s) configuring +one
>> or more bridges. + +@item @code{pluggable-transport} (default:
>> @code{"obfs4"}) +A string that specifies the type of the pluggable
>> transport in +case @code{#:transport-plugin} is not @code{#f}. + 
>> @end table @end deftp
>> 
>> diff --git a/gnu/services/networking.scm
>> b/gnu/services/networking.scm index 8e64e529ab..6e535ea8ef 100644 
>> --- a/gnu/services/networking.scm +++
>> b/gnu/services/networking.scm @@ -22,6 +22,7 @@ ;;; Copyright ©
>> 2023 Declan Tsien <declantsien@HIDDEN> ;;; Copyright © 2023
>> Bruno Victal <mirai@HIDDEN> ;;; Copyright © 2023 muradm
>> <mail@HIDDEN> +;;; Copyright © 2024 Nigko Yerden
>> <nigko.yerden@HIDDEN> ;;; ;;; This file is part of GNU Guix. 
>> ;;; @@ -159,6 +160,8 @@ (define-module (gnu services networking) 
>> tor-configuration-hidden-services 
>> tor-configuration-socks-socket-type 
>> tor-configuration-control-socket-path +
>> tor-configuration-transport-plugin-path +
>> tor-configuration-pluggable-transport 
>> tor-onion-service-configuration tor-onion-service-configuration? 
>> tor-onion-service-configuration-name @@ -955,7 +958,11 @@
>> (define-record-type* <tor-configuration> (socks-socket-type
>> tor-configuration-socks-socket-type ; 'tcp or 'unix (default
>> 'tcp)) (control-socket?  tor-configuration-control-socket-path -
>> (default #f))) +                    (default #f)) +
>> (transport-plugin tor-configuration-transport-plugin-path +
>> (default #f)) +  (pluggable-transport
>> tor-configuration-pluggable-transport +                    (default
>> "obfs4")))
>> 
>> (define %tor-accounts ;; User account and groups for Tor. @@ -988,7
>> +995,8 @@ (define-configuration/no-serialization
>> tor-onion-service-configuration (define (tor-configuration->torrc
>> config) "Return a 'torrc' file for CONFIG." (match-record config
>> <tor-configuration> -    (tor config-file hidden-services
>> socks-socket-type control-socket?) +    (tor config-file
>> hidden-services socks-socket-type control-socket? +
>> transport-plugin pluggable-transport) (computed-file "torrc" 
>> (with-imported-modules '((guix build utils)) @@ -1027,6 +1035,13 @@
>> (define (tor-configuration->torrc config) (cons name mapping))) 
>> hidden-services))
>> 
>> +               (when #$transport-plugin +                 (format
>> port "\ +UseBridges 1 +ClientTransportPlugin ~a exec ~a~%" +
>> #$pluggable-transport +
>> #$transport-plugin)) + (display "\ ### End of automatically
>> generated lines.\n\n" port)
> 
> Even if it had succeded though, I'm not sure if this is the best 
> approach to it, since it would break guix system configuration,
> right? How would one know beforehand which binary to point to? One
> would first need to install the PT and look to its path on store and
> then link to it in a new configuration. And then this link would have
> to be manualy updated. Am I missing something here?
> 
> Finally, next time, try to keep the issue to a single thread. I'm 
> replying to #70332 and #70302 just for reference, but let's keep to 
> #70341 going forward.
> 
> Cheers!




Information forwarded to guix-patches@HIDDEN:
bug#70341; Package guix-patches. Full text available.

Message received at 70341 <at> debbugs.gnu.org:


Received: (at 70341) by debbugs.gnu.org; 24 Apr 2024 21:12:26 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Wed Apr 24 17:12:25 2024
Received: from localhost ([127.0.0.1]:60172 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1rzjuX-0004wg-Go
	for submit <at> debbugs.gnu.org; Wed, 24 Apr 2024 17:12:25 -0400
Received: from mx1.riseup.net ([198.252.153.129]:55338)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <nandre@HIDDEN>)
 id 1rzju4-0004q1-OI; Wed, 24 Apr 2024 17:11:49 -0400
Received: from fews02-sea.riseup.net (fews02-sea-pn.riseup.net [10.0.1.112])
 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
 (No client certificate requested)
 by mx1.riseup.net (Postfix) with ESMTPS id 4VPs9P376wzDqpl;
 Wed, 24 Apr 2024 21:11:21 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak;
 t=1713993081; bh=4Mpfp/UFd1b9VZIflQ5T6LjKjPh5d8WA8EMdBh6YfH0=;
 h=Date:From:To:Cc:Subject:References:In-Reply-To:From;
 b=Pb8KdNMT7ryyji+r11s1Mtvee6wQ+1AfkYSU/darlfyOjyRmu5GZ2L3vnNZ86HXhi
 Iae4P2U8iansouUDDKx4tD+6alwdwgWZX8+Eu5Jk8CQaXQgRBrHWqdV6eb71dd5QmF
 wyHaIXhouHDTr9Od742uwAvKpQPXGqygSZUirg0I=
X-Riseup-User-ID: EC4B713CDDE1793CA0C25A09CE44E283C48F208BDCC843F933F0AD857702E801
Received: from [127.0.0.1] (localhost [127.0.0.1])
 by fews02-sea.riseup.net (Postfix) with ESMTPSA id 4VPs9M6XyTzFvfd;
 Wed, 24 Apr 2024 21:11:19 +0000 (UTC)
Date: Wed, 24 Apr 2024 18:11:10 -0300
From: =?iso-8859-1?Q?Andr=E9?= Batista <nandre@HIDDEN>
To: Nigko Yerden <nigko.yerden@HIDDEN>
Subject: Re: [bug#70341] [PATCH v3] services: tor: Add support for pluggable
 transports.
Message-ID: <Zil1buljj2AfL2zL@andel>
References: <11e72216f4be8b6559ecc04646fd722daa5dd09d.1712846897.git.nigko.yerden@HIDDEN>
 <3af678c4310a58373fe1e86b84f75a1d37e02295.1713758319.git.nigko.yerden@HIDDEN>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <3af678c4310a58373fe1e86b84f75a1d37e02295.1713758319.git.nigko.yerden@HIDDEN>
X-Spam-Score: -0.7 (/)
X-Debbugs-Envelope-To: 70341
Cc: 70332 <at> debbugs.gnu.org, 70302 <at> debbugs.gnu.org, 70341 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.7 (-)

Hi Nigko,

seg 22 abr 2024 s 08:58:39 (1713787119), nigko.yerden@HIDDEN enviou:
> Pluggable transports are programs that disguise Tor traffic, which
> can be useful in case Tor is censored.  Pluggable transports
> cannot be configured by #:config-file file exclusively because Tor
> process is run via 'least-authority-wrapper' and cannot have access
> to transport plugin, which is a separate executable (Bug#70302,
> Bug#70332).

I can confirm that the tor service is unable to fork-exec a
pluggable-transport and the bootstrap process is halted at its start
when trying to use a system wide bridge + PT. However, this patch
does not seem to address the issue at hand, since it just creates
new tor-service-type configuration options that accomplish the
same as configuring on config-file directly. Have you had success
with this? I had no luck.

More comments bellow.

> * doc/guix.texi (Networking Services): Document 'transport-plugin' and
> 'pluggable-transport' options for 'tor-configuration'.
> * gnu/services/networking.scm: Export 'tor-configuration-transport-plugin-path',
> 'tor-configuration-pluggable-transport'.
> (<tor-configuration>): Add 'transport-plugin' and 'pluggable-transport'
> fields.
> (tor-configuration->torrc)[transport-plugin]: Add content to 'torrc'
> computed-file.
> (tor-shepherd-service)[transport-plugin]: Add file-system-mapping.
> 
> Change-Id: I64e7632729287ea0ab27818bb7322fddae43de48
> ---
>  doc/guix.texi               | 11 ++++++++
>  gnu/services/networking.scm | 54 ++++++++++++++++++++++++++-----------
>  2 files changed, 49 insertions(+), 16 deletions(-)
> 
> diff --git a/doc/guix.texi b/doc/guix.texi
> index 65af136e61..eb0837860e 100644
> --- a/doc/guix.texi
> +++ b/doc/guix.texi
> @@ -127,6 +127,7 @@
>  Copyright @copyright{} 2024 Herman Rimm@*
>  Copyright @copyright{} 2024 Matthew Trzcinski@*
>  Copyright @copyright{} 2024 Richard Sent@*
> +Copyright @copyright{} 2024 Nigko Yerden@*
>  
>  Permission is granted to copy, distribute and/or modify this document
>  under the terms of the GNU Free Documentation License, Version 1.3 or
> @@ -21849,6 +21850,16 @@ Networking Services
>  @file{/var/run/tor/control-sock}, which will be made writable by members of the
>  @code{tor} group.
>  
> +@item @code{transport-plugin} (default: @code{#f})
> +This must be either @code{#f} or a ``file-like'' object pointing to the
> +pluggable transport plugin executable.  In the latter case the
> +@code{#:config-file} file should contain line(s) configuring
> +one or more bridges.
> +
> +@item @code{pluggable-transport} (default: @code{"obfs4"})
> +A string that specifies the type of the pluggable transport in
> +case @code{#:transport-plugin} is not @code{#f}.
> +
>  @end table
>  @end deftp
>  
> diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
> index 8e64e529ab..6e535ea8ef 100644
> --- a/gnu/services/networking.scm
> +++ b/gnu/services/networking.scm
> @@ -22,6 +22,7 @@
>  ;;; Copyright  2023 Declan Tsien <declantsien@HIDDEN>
>  ;;; Copyright  2023 Bruno Victal <mirai@HIDDEN>
>  ;;; Copyright  2023 muradm <mail@HIDDEN>
> +;;; Copyright  2024 Nigko Yerden <nigko.yerden@HIDDEN>
>  ;;;
>  ;;; This file is part of GNU Guix.
>  ;;;
> @@ -159,6 +160,8 @@ (define-module (gnu services networking)
>              tor-configuration-hidden-services
>              tor-configuration-socks-socket-type
>              tor-configuration-control-socket-path
> +            tor-configuration-transport-plugin-path
> +            tor-configuration-pluggable-transport
>              tor-onion-service-configuration
>              tor-onion-service-configuration?
>              tor-onion-service-configuration-name
> @@ -955,7 +958,11 @@ (define-record-type* <tor-configuration>
>    (socks-socket-type tor-configuration-socks-socket-type ; 'tcp or 'unix
>                       (default 'tcp))
>    (control-socket?  tor-configuration-control-socket-path
> -                    (default #f)))
> +                    (default #f))
> +  (transport-plugin tor-configuration-transport-plugin-path
> +                    (default #f))
> +  (pluggable-transport tor-configuration-pluggable-transport
> +                    (default "obfs4")))
>  
>  (define %tor-accounts
>    ;; User account and groups for Tor.
> @@ -988,7 +995,8 @@ (define-configuration/no-serialization tor-onion-service-configuration
>  (define (tor-configuration->torrc config)
>    "Return a 'torrc' file for CONFIG."
>    (match-record config <tor-configuration>
> -    (tor config-file hidden-services socks-socket-type control-socket?)
> +    (tor config-file hidden-services socks-socket-type control-socket?
> +         transport-plugin pluggable-transport)
>      (computed-file
>       "torrc"
>       (with-imported-modules '((guix build utils))
> @@ -1027,6 +1035,13 @@ (define (tor-configuration->torrc config)
>                                      (cons name mapping)))
>                                   hidden-services))
>  
> +               (when #$transport-plugin
> +                 (format port "\
> +UseBridges 1
> +ClientTransportPlugin ~a exec ~a~%"
> +                         #$pluggable-transport
> +                         #$transport-plugin))
> +
>                 (display "\
>  ### End of automatically generated lines.\n\n" port)

Even if it had succeded though, I'm not sure if this is the best
approach to it, since it would break guix system configuration, right?
How would one know beforehand which binary to point to? One would first
need to install the PT and look to its path on store and then link to
it in a new configuration. And then this link would have to be manualy
updated. Am I missing something here?

Finally, next time, try to keep the issue to a single thread. I'm
replying to #70332 and #70302 just for reference, but let's keep to
#70341 going forward.

Cheers!




Information forwarded to guix-patches@HIDDEN:
bug#70341; Package guix-patches. Full text available.

Message received at 70341 <at> debbugs.gnu.org:


Received: (at 70341) by debbugs.gnu.org; 22 Apr 2024 04:00:27 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Mon Apr 22 00:00:27 2024
Received: from localhost ([127.0.0.1]:45335 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1rykqw-0003Fj-HH
	for submit <at> debbugs.gnu.org; Mon, 22 Apr 2024 00:00:27 -0400
Received: from mail-lj1-x244.google.com ([2a00:1450:4864:20::244]:43185)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <nigko.yerden@HIDDEN>) id 1rykqq-0003Ef-R0
 for 70341 <at> debbugs.gnu.org; Mon, 22 Apr 2024 00:00:25 -0400
Received: by mail-lj1-x244.google.com with SMTP id
 38308e7fff4ca-2d872102372so37336601fa.0
 for <70341 <at> debbugs.gnu.org>; Sun, 21 Apr 2024 21:00:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=gmail.com; s=20230601; t=1713758398; x=1714363198; darn=debbugs.gnu.org;
 h=content-transfer-encoding:mime-version:message-id:date:subject:cc
 :to:from:from:to:cc:subject:date:message-id:reply-to;
 bh=g4LsYtQrFF9cYf4DGGX2LknC+LGEH/Rg9sHLzc/IhkI=;
 b=nKdqpJWXx75CE78qWDwubMPJPrEcGdFZrAaqFmb1T66yHg8jPW3mmjxjtXEZMn5rgO
 t+WJF6tEUO7q/IXHaRFIkxhjSQXV7g+UF7RMQ2vaAxXu5IISOF4sl3W/UFUjA5GLVqIX
 Cr6onqoEj0/97zxaiki9ta9waBlFZOS5Z92uXnMOX51ODQxzU4OK/27tcNlxmpVGhJjt
 T9ePS3yeqkIcsbvmZRomg4lit77PQI8iSSWfonqlvAbROVezSWJj20BR0RdYdIN9tGrl
 oZFL9+SEK3/lXpk69ELKYzCVHbmlQl04vIi28NbtzoaLRryU2oIGBkrrRJorCfew8fE/
 y1vA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1713758398; x=1714363198;
 h=content-transfer-encoding:mime-version:message-id:date:subject:cc
 :to:from:x-gm-message-state:from:to:cc:subject:date:message-id
 :reply-to;
 bh=g4LsYtQrFF9cYf4DGGX2LknC+LGEH/Rg9sHLzc/IhkI=;
 b=RdzhtCZOA1BkwqExhdYM6OFXrP9pnSh/H4Ig4+UQ2EzJDmahNu0t9zi4Bo9C8/siaL
 6QArmGzyGGO0S67A+yPulDO7RweM1MuEVYBx6opNFqaEJGCZE5Rz/Iz+9YvFnxngueJ8
 fD37+9YR4Fhw5wwGgTNg6ejHGgfsuatjQ6NyQDIkUh6Iqh7p92FFPsG6gIpxr5EhHaCX
 iuz/FgO4oFGLVTA+NWWYUewDM22Ev5YBGE1KqssFt0ABUs6Dxm9V/SNILJ5P9Iz+Gr6L
 OAmuiC02kccrUj2ik0wd7/BCPP/BKLm+8bcCtCyUoJ/7dUFlQNn1y4LCSplIrWvyUoxw
 sK/w==
X-Gm-Message-State: AOJu0YzhpGkkXkXWoQY8cGaAttYKQxV3jdx3UvjInC3I2RMm72IcG4Hk
 tbB7V6t5KKuDvEEk6aGBiA3tr9JHs4MDCOBZl2DdRtYzMGUOxHQctAWhAunV
X-Google-Smtp-Source: AGHT+IFVgKx8qcyYxcyWXlqNk83W9Qaz/5nIvAAfeSmzufp3w71n+2C5mB1nDX2OC1os8Z5QklRaFg==
X-Received: by 2002:a05:651c:33a:b0:2d9:36af:d224 with SMTP id
 b26-20020a05651c033a00b002d936afd224mr3004587ljp.1.1713758397476; 
 Sun, 21 Apr 2024 20:59:57 -0700 (PDT)
Received: from localhost.localdomain ([188.244.176.248])
 by smtp.gmail.com with ESMTPSA id
 z19-20020a2e8e93000000b002d8a12e3d90sm1339702ljk.122.2024.04.21.20.59.56
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Sun, 21 Apr 2024 20:59:57 -0700 (PDT)
From: Nigko Yerden <nigko.yerden@HIDDEN>
To: 70341 <at> debbugs.gnu.org
Subject: [PATCH v3] services: tor: Add support for pluggable transports.
Date: Mon, 22 Apr 2024 08:58:39 +0500
Message-ID: <3af678c4310a58373fe1e86b84f75a1d37e02295.1713758319.git.nigko.yerden@HIDDEN>
X-Mailer: git-send-email 2.41.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 70341
Cc: Nigko Yerden <nigko.yerden@HIDDEN>
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Pluggable transports are programs that disguise Tor traffic, which
can be useful in case Tor is censored.  Pluggable transports
cannot be configured by #:config-file file exclusively because Tor
process is run via 'least-authority-wrapper' and cannot have access
to transport plugin, which is a separate executable (Bug#70302,
Bug#70332).

* doc/guix.texi (Networking Services): Document 'transport-plugin' and
'pluggable-transport' options for 'tor-configuration'.
* gnu/services/networking.scm: Export 'tor-configuration-transport-plugin-path',
'tor-configuration-pluggable-transport'.
(<tor-configuration>): Add 'transport-plugin' and 'pluggable-transport'
fields.
(tor-configuration->torrc)[transport-plugin]: Add content to 'torrc'
computed-file.
(tor-shepherd-service)[transport-plugin]: Add file-system-mapping.

Change-Id: I64e7632729287ea0ab27818bb7322fddae43de48
---
 doc/guix.texi               | 11 ++++++++
 gnu/services/networking.scm | 54 ++++++++++++++++++++++++++-----------
 2 files changed, 49 insertions(+), 16 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index 65af136e61..eb0837860e 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -127,6 +127,7 @@
 Copyright @copyright{} 2024 Herman Rimm@*
 Copyright @copyright{} 2024 Matthew Trzcinski@*
 Copyright @copyright{} 2024 Richard Sent@*
+Copyright @copyright{} 2024 Nigko Yerden@*
 
 Permission is granted to copy, distribute and/or modify this document
 under the terms of the GNU Free Documentation License, Version 1.3 or
@@ -21849,6 +21850,16 @@ Networking Services
 @file{/var/run/tor/control-sock}, which will be made writable by members of the
 @code{tor} group.
 
+@item @code{transport-plugin} (default: @code{#f})
+This must be either @code{#f} or a ``file-like'' object pointing to the
+pluggable transport plugin executable.  In the latter case the
+@code{#:config-file} file should contain line(s) configuring
+one or more bridges.
+
+@item @code{pluggable-transport} (default: @code{"obfs4"})
+A string that specifies the type of the pluggable transport in
+case @code{#:transport-plugin} is not @code{#f}.
+
 @end table
 @end deftp
 
diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
index 8e64e529ab..6e535ea8ef 100644
--- a/gnu/services/networking.scm
+++ b/gnu/services/networking.scm
@@ -22,6 +22,7 @@
 ;;; Copyright © 2023 Declan Tsien <declantsien@HIDDEN>
 ;;; Copyright © 2023 Bruno Victal <mirai@HIDDEN>
 ;;; Copyright © 2023 muradm <mail@HIDDEN>
+;;; Copyright © 2024 Nigko Yerden <nigko.yerden@HIDDEN>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -159,6 +160,8 @@ (define-module (gnu services networking)
             tor-configuration-hidden-services
             tor-configuration-socks-socket-type
             tor-configuration-control-socket-path
+            tor-configuration-transport-plugin-path
+            tor-configuration-pluggable-transport
             tor-onion-service-configuration
             tor-onion-service-configuration?
             tor-onion-service-configuration-name
@@ -955,7 +958,11 @@ (define-record-type* <tor-configuration>
   (socks-socket-type tor-configuration-socks-socket-type ; 'tcp or 'unix
                      (default 'tcp))
   (control-socket?  tor-configuration-control-socket-path
-                    (default #f)))
+                    (default #f))
+  (transport-plugin tor-configuration-transport-plugin-path
+                    (default #f))
+  (pluggable-transport tor-configuration-pluggable-transport
+                    (default "obfs4")))
 
 (define %tor-accounts
   ;; User account and groups for Tor.
@@ -988,7 +995,8 @@ (define-configuration/no-serialization tor-onion-service-configuration
 (define (tor-configuration->torrc config)
   "Return a 'torrc' file for CONFIG."
   (match-record config <tor-configuration>
-    (tor config-file hidden-services socks-socket-type control-socket?)
+    (tor config-file hidden-services socks-socket-type control-socket?
+         transport-plugin pluggable-transport)
     (computed-file
      "torrc"
      (with-imported-modules '((guix build utils))
@@ -1027,6 +1035,13 @@ (define (tor-configuration->torrc config)
                                     (cons name mapping)))
                                  hidden-services))
 
+               (when #$transport-plugin
+                 (format port "\
+UseBridges 1
+ClientTransportPlugin ~a exec ~a~%"
+                         #$pluggable-transport
+                         #$transport-plugin))
+
                (display "\
 ### End of automatically generated lines.\n\n" port)
 
@@ -1039,23 +1054,30 @@ (define (tor-configuration->torrc config)
 (define (tor-shepherd-service config)
   "Return a <shepherd-service> running Tor."
   (let* ((torrc (tor-configuration->torrc config))
+         (transport-plugin-path (tor-configuration-transport-plugin-path config))
          (tor   (least-authority-wrapper
                  (file-append (tor-configuration-tor config) "/bin/tor")
                  #:name "tor"
-                 #:mappings (list (file-system-mapping
-                                   (source "/var/lib/tor")
-                                   (target source)
-                                   (writable? #t))
-                                  (file-system-mapping
-                                   (source "/dev/log") ;for syslog
-                                   (target source))
-                                  (file-system-mapping
-                                   (source "/var/run/tor")
-                                   (target source)
-                                   (writable? #t))
-                                  (file-system-mapping
-                                   (source torrc)
-                                   (target source)))
+                 #:mappings (append
+                             (list (file-system-mapping
+                                    (source "/var/lib/tor")
+                                    (target source)
+                                    (writable? #t))
+                                   (file-system-mapping
+                                    (source "/dev/log") ;for syslog
+                                    (target source))
+                                   (file-system-mapping
+                                    (source "/var/run/tor")
+                                    (target source)
+                                    (writable? #t))
+                                   (file-system-mapping
+                                    (source torrc)
+                                    (target source)))
+                             (if transport-plugin-path
+                                 (list (file-system-mapping
+                                        (source transport-plugin-path)
+                                        (target source)))
+                                 '()))
                  #:namespaces (delq 'net %namespaces))))
     (list (shepherd-service
            (provision '(tor))

base-commit: 9fa34ad616b94ad881b5ca48ef88bd84f877a0e9
-- 
2.41.0





Information forwarded to guix-patches@HIDDEN:
bug#70341; Package guix-patches. Full text available.

Message received at 70341 <at> debbugs.gnu.org:


Received: (at 70341) by debbugs.gnu.org; 20 Apr 2024 14:45:13 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Apr 20 10:45:13 2024
Received: from localhost ([127.0.0.1]:36649 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1ryBxo-00076q-Vn
	for submit <at> debbugs.gnu.org; Sat, 20 Apr 2024 10:45:13 -0400
Received: from mail-lf1-x144.google.com ([2a00:1450:4864:20::144]:56431)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <nigko.yerden@HIDDEN>) id 1ryBxl-00076g-Cb
 for 70341 <at> debbugs.gnu.org; Sat, 20 Apr 2024 10:45:10 -0400
Received: by mail-lf1-x144.google.com with SMTP id
 2adb3069b0e04-516d4d80d00so3809759e87.0
 for <70341 <at> debbugs.gnu.org>; Sat, 20 Apr 2024 07:44:54 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=gmail.com; s=20230601; t=1713624288; x=1714229088; darn=debbugs.gnu.org;
 h=content-transfer-encoding:mime-version:message-id:date:subject:cc
 :to:from:from:to:cc:subject:date:message-id:reply-to;
 bh=hzMggZRHPhx9LlQJHpLbUh6ZYrpKzlOeJlfRlaBIXjU=;
 b=Nz3/pywO933DMoQXL0H7FNK6E8SH6KBj7DZxfMbeExIw2B3/Eoe4DmXIqGJRSuprBu
 DttOKsg+CBWcdUjJBOatv8HdfPTerp4VqLT6MV6OzWNKE5T8UkfTlPyXG/zkhE2sZvBK
 eqFiY9Kt9NLBkzD1jSUW7afKNSrkDT9MUHwjx/YoE3OfWG9V5iWqwVoNhOs0MKVq0B2/
 y+aF1ZXIaGyPlgS0FffaLyWjj67EAJ79FFvbcN0TGh7H8be4OcuLu89Jw9FJm04ichvN
 U+a/BgMsOFDKtEjUAvd4lvskZzZZ5ptV5zrAKTieQkuTjho8NEgA56bf+Ll7pBlgtUZd
 aaNA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1713624288; x=1714229088;
 h=content-transfer-encoding:mime-version:message-id:date:subject:cc
 :to:from:x-gm-message-state:from:to:cc:subject:date:message-id
 :reply-to;
 bh=hzMggZRHPhx9LlQJHpLbUh6ZYrpKzlOeJlfRlaBIXjU=;
 b=obGuMo8o5+uHh1xV5gBXwROui7oALvEI0FRAzgt+9ZcpXVMJhhlsCkbz/Oq/9HhCOD
 bpYlrOpaDhp4+BDyxXfb/SWXvaWci86bKbdzR/qGYhsOvxnLBn92V+26GHgHMdIyzcnH
 c5Oi9cP1YgI46WWO1uivxLxpK9TI0P1JzzqO+8A0Vfz5KC+8qxTPFfiKvRTu3P71+gVM
 YFRfIFbJWpK0+Z0oujpmRtkLhzO6OP1x9vxv11DIjRg0SHICvyztnX9o3Ej3t+Ur+SDd
 W94nTDsm90O9/HZFx1Rns+87wj0wyFynwlAI1nZrjXNinrgesxMuxu9VbkMDbtxbmxHt
 U/9w==
X-Gm-Message-State: AOJu0Yx4eayndDMEkpBMHudjle8nH5wlF3CBV1qzg8Ma8au/pdzlgxZS
 wcBADkLZt1lMUT20QWYoOF0X0mjnoFvdR/MpZYvINTri9koywQQ5J0IGKbDd
X-Google-Smtp-Source: AGHT+IE5FVaIBqgD4IatsdJ2kvzqhyWxUOA9alkB0PvDlcdQwE03YxRh1rQSLJ+CjJtNspY9nnvpFA==
X-Received: by 2002:a05:6512:3b96:b0:51a:c9a2:58e with SMTP id
 g22-20020a0565123b9600b0051ac9a2058emr3481491lfv.29.1713624287770; 
 Sat, 20 Apr 2024 07:44:47 -0700 (PDT)
Received: from localhost.localdomain ([188.68.139.217])
 by smtp.gmail.com with ESMTPSA id
 h7-20020a056512220700b0051ac9a1cbdbsm625736lfu.50.2024.04.20.07.44.47
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Sat, 20 Apr 2024 07:44:47 -0700 (PDT)
From: Nigko Yerden <nigko.yerden@HIDDEN>
To: 70341 <at> debbugs.gnu.org
Subject: [PATCH v2] services: tor: Add support for pluggable transports.
Date: Sat, 20 Apr 2024 19:43:03 +0500
Message-ID: <714e3316b5a14168c495253ae585c9e73361b11a.1713624182.git.nigko.yerden@HIDDEN>
X-Mailer: git-send-email 2.41.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 70341
Cc: Nigko Yerden <nigko.yerden@HIDDEN>
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Pluggable transports are programs that disguise Tor traffic, which
can be useful in cases when Tor is censored.  Pluggable transports
cannot be configured by #:config-file file exclusively because Tor
process is run via 'least-authority-wrapper' and cannot have access
to transport plugin, which is a separate executable (Bug:#70302,
Bug:#70332).

* doc/guix.texi (Networking Services): Document 'transport-plugin' and
'pluggable-transport' options for 'tor-configuration'.
* gnu/services/networking.scm (<tor-configuration>): Add 'transport-plugin'
and 'pluggable-transport' fields.
(tor-configuration->torrc)[transport-plugin]: Add content to 'torrc'
computed-file.
(tor-shepherd-service)[transport-plugin-path]: Add file-system-mapping.

Change-Id: I64e7632729287ea0ab27818bb7322fddae43de48
---
 doc/guix.texi               | 11 ++++++++
 gnu/services/networking.scm | 52 +++++++++++++++++++++++++------------
 2 files changed, 47 insertions(+), 16 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index 65af136e61..9fbe928484 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -127,6 +127,7 @@
 Copyright @copyright{} 2024 Herman Rimm@*
 Copyright @copyright{} 2024 Matthew Trzcinski@*
 Copyright @copyright{} 2024 Richard Sent@*
+Copyright @copyright{} 2024 Nigko Yerden@*
 
 Permission is granted to copy, distribute and/or modify this document
 under the terms of the GNU Free Documentation License, Version 1.3 or
@@ -21849,6 +21850,16 @@ Networking Services
 @file{/var/run/tor/control-sock}, which will be made writable by members of the
 @code{tor} group.
 
+@item @code{transport-plugin} (default: @code{#f})
+This must be either @code{#f}, in which case the pluggable transports are
+not used by Tor, or a ``file-like'' object pointing to the pluggable transport
+plugin executable.  In the latter case the @code{#:config-file} file
+should contain line(s) configuring one or more bridges.
+
+@item @code{pluggable-transport} (default: @code{"obfs4"})
+A string that specifies the type of the pluggable transport in
+case @code{#:transport-plugin} is not @code{#f}.
+
 @end table
 @end deftp
 
diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
index 8e64e529ab..e47f7ca61a 100644
--- a/gnu/services/networking.scm
+++ b/gnu/services/networking.scm
@@ -22,6 +22,7 @@
 ;;; Copyright © 2023 Declan Tsien <declantsien@HIDDEN>
 ;;; Copyright © 2023 Bruno Victal <mirai@HIDDEN>
 ;;; Copyright © 2023 muradm <mail@HIDDEN>
+;;; Copyright © 2024 Nigko Yerden <nigko.yerden@HIDDEN>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -955,7 +956,11 @@ (define-record-type* <tor-configuration>
   (socks-socket-type tor-configuration-socks-socket-type ; 'tcp or 'unix
                      (default 'tcp))
   (control-socket?  tor-configuration-control-socket-path
-                    (default #f)))
+                    (default #f))
+  (transport-plugin tor-configuration-transport-plugin-path
+                    (default #f))
+  (pluggable-transport tor-configuration-pluggable-transport
+                    (default "obfs4")))
 
 (define %tor-accounts
   ;; User account and groups for Tor.
@@ -988,7 +993,8 @@ (define-configuration/no-serialization tor-onion-service-configuration
 (define (tor-configuration->torrc config)
   "Return a 'torrc' file for CONFIG."
   (match-record config <tor-configuration>
-    (tor config-file hidden-services socks-socket-type control-socket?)
+    (tor config-file hidden-services socks-socket-type control-socket?
+         transport-plugin pluggable-transport)
     (computed-file
      "torrc"
      (with-imported-modules '((guix build utils))
@@ -1027,6 +1033,13 @@ (define (tor-configuration->torrc config)
                                     (cons name mapping)))
                                  hidden-services))
 
+               (when #$transport-plugin
+                 (format port "\
+UseBridges 1
+ClientTransportPlugin ~a exec ~a~%"
+                         #$pluggable-transport
+                         #$transport-plugin))
+
                (display "\
 ### End of automatically generated lines.\n\n" port)
 
@@ -1039,23 +1052,30 @@ (define (tor-configuration->torrc config)
 (define (tor-shepherd-service config)
   "Return a <shepherd-service> running Tor."
   (let* ((torrc (tor-configuration->torrc config))
+         (transport-plugin-path (tor-configuration-transport-plugin-path config))
          (tor   (least-authority-wrapper
                  (file-append (tor-configuration-tor config) "/bin/tor")
                  #:name "tor"
-                 #:mappings (list (file-system-mapping
-                                   (source "/var/lib/tor")
-                                   (target source)
-                                   (writable? #t))
-                                  (file-system-mapping
-                                   (source "/dev/log") ;for syslog
-                                   (target source))
-                                  (file-system-mapping
-                                   (source "/var/run/tor")
-                                   (target source)
-                                   (writable? #t))
-                                  (file-system-mapping
-                                   (source torrc)
-                                   (target source)))
+                 #:mappings (append
+                             (list (file-system-mapping
+                                    (source "/var/lib/tor")
+                                    (target source)
+                                    (writable? #t))
+                                   (file-system-mapping
+                                    (source "/dev/log") ;for syslog
+                                    (target source))
+                                   (file-system-mapping
+                                    (source "/var/run/tor")
+                                    (target source)
+                                    (writable? #t))
+                                   (file-system-mapping
+                                    (source torrc)
+                                    (target source)))
+                             (if transport-plugin-path
+                                 (list (file-system-mapping
+                                        (source transport-plugin-path)
+                                        (target source)))
+                                 '()))
                  #:namespaces (delq 'net %namespaces))))
     (list (shepherd-service
            (provision '(tor))

base-commit: 0f68306268773f0eaa4327e1f6fdcb39442e4a34
-- 
2.41.0





Information forwarded to guix-patches@HIDDEN:
bug#70341; Package guix-patches. Full text available.

Message received at submit <at> debbugs.gnu.org:


Received: (at submit) by debbugs.gnu.org; 11 Apr 2024 14:53:08 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Thu Apr 11 10:53:08 2024
Received: from localhost ([127.0.0.1]:57120 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1ruvnS-00084Z-MK
	for submit <at> debbugs.gnu.org; Thu, 11 Apr 2024 10:53:08 -0400
Received: from lists.gnu.org ([2001:470:142::17]:37974)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <nigko.yerden@HIDDEN>) id 1ruvnH-00082i-Cr
 for submit <at> debbugs.gnu.org; Thu, 11 Apr 2024 10:53:00 -0400
Received: from eggs.gnu.org ([2001:470:142:3::10])
 by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <nigko.yerden@HIDDEN>)
 id 1ruvn2-0008Ki-Fd
 for guix-patches@HIDDEN; Thu, 11 Apr 2024 10:52:36 -0400
Received: from mail-lf1-x142.google.com ([2a00:1450:4864:20::142])
 by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)
 (Exim 4.90_1) (envelope-from <nigko.yerden@HIDDEN>)
 id 1ruvn0-0005h0-EM
 for guix-patches@HIDDEN; Thu, 11 Apr 2024 10:52:36 -0400
Received: by mail-lf1-x142.google.com with SMTP id
 2adb3069b0e04-516d2b9cd69so7757974e87.2
 for <guix-patches@HIDDEN>; Thu, 11 Apr 2024 07:52:34 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=gmail.com; s=20230601; t=1712847152; x=1713451952; darn=gnu.org;
 h=content-transfer-encoding:mime-version:message-id:date:subject:cc
 :to:from:from:to:cc:subject:date:message-id:reply-to;
 bh=YYY7kjDfOZ5Ajf8MkugofC5vefxa6E7lNmwb/V78s84=;
 b=Vdqyxod+hNwAx+t/vJ5eVg1vXEW992dWrUb+VvnDQ+xA9mz5SC4ZtqXbKwuDsWAv4E
 VCTbKFQRU5y8OKZAXZJAy+IPmmKZrLh2MSEATxVYx91iizNnUZzg5GGogROL3MAw/O7b
 3JE9v+Fydy/oqbIojc+tFzyvW0W2c01Kw1CShd13tMBx0JACAsJwmH8zCS3y1qs05UMp
 FJMbw9AHmB8N7lIGMo4k7GalkJveWT7+ok8juEJAQLFMgV7fKyqwmpNR8QaTcG21RUER
 /7iocGEdlS4BLNkyALxvXCIMwILnR09w7yDmOplfoqx4Bodzgu9g9OB3FSmd4NwfR5AI
 CLhA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1712847152; x=1713451952;
 h=content-transfer-encoding:mime-version:message-id:date:subject:cc
 :to:from:x-gm-message-state:from:to:cc:subject:date:message-id
 :reply-to;
 bh=YYY7kjDfOZ5Ajf8MkugofC5vefxa6E7lNmwb/V78s84=;
 b=shqpLhp9rXIjtBBxZnvHmdFVkybpyl2Zb+tIvMEkvmez9w+YKNfYi+9F769rhakUQJ
 GyO21dN5DPAHT6biywR02ikc1eXGqkEX2P2NU2VN+N4rN6GxeNBUkse72wg0M0ZhXjr7
 7S6HZ3L6xSY/b2AEZ7ld9eyf3emTNUkg3Jzt/zPqcojSS0Jd8NvlMW0QBtTbs9Zhj5pB
 IcL3ixE8tpVmZHT6WNt2LitA0d4GP4Q7oleyuOuh3UWvuPcFMH0QqFHDJcf6XO9QucIh
 a1aHO899Pvtayzn1bZ0eAPHAFP5XgP6/EFOxytcVkCC0ULkIYGiX9ZSH1ZXw7SzuadJQ
 Tk/g==
X-Gm-Message-State: AOJu0YwEU+VuU38oVuY17ZPUYoTqNe18602mz3ggHUHELn5bxJl5YwzO
 Xm4XhgjJNW0vXMWtw9BQhdX1LsrqK7+teaYdHzXGmVWiCRa0Sfg0e22QypEr
X-Google-Smtp-Source: AGHT+IH7VTrST6KEhsFjxu+ZypLWKsTHHYtpEzswykqTXre3xW7GPbKpAxf7giHBMM0QXdutkBzkbQ==
X-Received: by 2002:a05:6512:159e:b0:516:bea8:f46e with SMTP id
 bp30-20020a056512159e00b00516bea8f46emr4529157lfb.61.1712847151939; 
 Thu, 11 Apr 2024 07:52:31 -0700 (PDT)
Received: from localhost.localdomain ([188.168.230.169])
 by smtp.gmail.com with ESMTPSA id
 y5-20020ac24465000000b00516d2184388sm226563lfl.177.2024.04.11.07.52.31
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Thu, 11 Apr 2024 07:52:31 -0700 (PDT)
From: Nigko Yerden <nigko.yerden@HIDDEN>
To: guix-patches@HIDDEN
Subject: [PATCH] gnu: Add support for pluggable transports to tor-service-type
Date: Thu, 11 Apr 2024 19:48:17 +0500
Message-ID: <11e72216f4be8b6559ecc04646fd722daa5dd09d.1712846897.git.nigko.yerden@HIDDEN>
X-Mailer: git-send-email 2.41.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Received-SPF: pass client-ip=2a00:1450:4864:20::142;
 envelope-from=nigko.yerden@HIDDEN; helo=mail-lf1-x142.google.com
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001,
 RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,
 SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: submit
Cc: Nigko Yerden <nigko.yerden@HIDDEN>
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -0.0 (/)

In Tor parlance pluggable transports are programs that disguise
Tor traffic, which is useful, e.g., for censorship circumvention.
There are several types of pluggable transports, e.g.,
obfs4 (lyrebird), meek, Snowflake etc.

There are pluggable transport plugins in guix repo:
go-gitlab-torproject-org-tpo-anti-censorship-pluggable-transports-lyrebird
go-github-com-operatorfoundation-obfs4

This commit adds the following #:-fields to tor-configuration
record type:

transport-plugin?   - /path/to/transport/plugin/binary (string)
		      (default #f)

pluggable-transport - type of pluggable transport (string)
		      (default "obfs4")

Since tor process is run by shepherd service inside Linux
namespaces, we need to add path to transport plugin to
the list of file system mappings in the argument of
list-authority-wrapper function.

Pluggable transports do not work without bridges,
which can be obtained from the official site
https://bridges.torproject.org/. The user should specify
bridges in #:config-file field of the tor-configuration
record. For expample obfs4 bridges are specified as follows

Bridge obfs4  ...
Bridge obfs4  ...

Change-Id: I64e7632729287ea0ab27818bb7322fddae43de48
---
Hello Guix!

This is a bug-fix for
https://lists.gnu.org/archive/html/bug-guix/2024-04/msg00093.html,
see also
https://lists.gnu.org/archive/html/bug-guix/2024-04/msg00093.html.


Best Regards,
Nigko Yerden

 gnu/services/networking.scm | 52 +++++++++++++++++++++++++------------
 1 file changed, 36 insertions(+), 16 deletions(-)

diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
index 8e64e529ab..b7d9a878e9 100644
--- a/gnu/services/networking.scm
+++ b/gnu/services/networking.scm
@@ -22,6 +22,7 @@
 ;;; Copyright © 2023 Declan Tsien <declantsien@HIDDEN>
 ;;; Copyright © 2023 Bruno Victal <mirai@HIDDEN>
 ;;; Copyright © 2023 muradm <mail@HIDDEN>
+;;; Copyright © 2024 Nigko Yerden <nigko.yerden@HIDDEN>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -955,7 +956,11 @@ (define-record-type* <tor-configuration>
   (socks-socket-type tor-configuration-socks-socket-type ; 'tcp or 'unix
                      (default 'tcp))
   (control-socket?  tor-configuration-control-socket-path
-                    (default #f)))
+                    (default #f))
+  (transport-plugin? tor-configuration-transport-plugin-path
+                    (default #f))
+  (pluggable-transport tor-configuration-pluggable-transport
+                    (default "obfs4")))
 
 (define %tor-accounts
   ;; User account and groups for Tor.
@@ -988,7 +993,8 @@ (define-configuration/no-serialization tor-onion-service-configuration
 (define (tor-configuration->torrc config)
   "Return a 'torrc' file for CONFIG."
   (match-record config <tor-configuration>
-    (tor config-file hidden-services socks-socket-type control-socket?)
+    (tor config-file hidden-services socks-socket-type control-socket?
+         transport-plugin? pluggable-transport)
     (computed-file
      "torrc"
      (with-imported-modules '((guix build utils))
@@ -1027,6 +1033,13 @@ (define (tor-configuration->torrc config)
                                     (cons name mapping)))
                                  hidden-services))
 
+               (when #$transport-plugin?
+                 (format port "\
+UseBridges 1
+ClientTransportPlugin ~a exec ~a~%"
+                         #$pluggable-transport
+                         #$transport-plugin?))
+
                (display "\
 ### End of automatically generated lines.\n\n" port)
 
@@ -1039,23 +1052,30 @@ (define (tor-configuration->torrc config)
 (define (tor-shepherd-service config)
   "Return a <shepherd-service> running Tor."
   (let* ((torrc (tor-configuration->torrc config))
+         (transport-plugin-path (tor-configuration-transport-plugin-path config))
          (tor   (least-authority-wrapper
                  (file-append (tor-configuration-tor config) "/bin/tor")
                  #:name "tor"
-                 #:mappings (list (file-system-mapping
-                                   (source "/var/lib/tor")
-                                   (target source)
-                                   (writable? #t))
-                                  (file-system-mapping
-                                   (source "/dev/log") ;for syslog
-                                   (target source))
-                                  (file-system-mapping
-                                   (source "/var/run/tor")
-                                   (target source)
-                                   (writable? #t))
-                                  (file-system-mapping
-                                   (source torrc)
-                                   (target source)))
+                 #:mappings (append
+                             (list (file-system-mapping
+                                    (source "/var/lib/tor")
+                                    (target source)
+                                    (writable? #t))
+                                   (file-system-mapping
+                                    (source "/dev/log") ;for syslog
+                                    (target source))
+                                   (file-system-mapping
+                                    (source "/var/run/tor")
+                                    (target source)
+                                    (writable? #t))
+                                   (file-system-mapping
+                                    (source torrc)
+                                    (target source)))
+                             (if transport-plugin-path
+                                 (list (file-system-mapping
+                                        (source transport-plugin-path)
+                                        (target source)))
+                                 '()))
                  #:namespaces (delq 'net %namespaces))))
     (list (shepherd-service
            (provision '(tor))

base-commit: 4e7337536ba41e888a601c92fada8a4adca9d2c6
-- 
2.41.0





Acknowledgement sent to Nigko Yerden <nigko.yerden@HIDDEN>:
New bug report received and forwarded. Copy sent to guix-patches@HIDDEN. Full text available.
Report forwarded to guix-patches@HIDDEN:
bug#70341; Package guix-patches. Full text available.
Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.
Last modified: Fri, 10 May 2024 08:45:01 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.