Use random ports for Tor ORPort and obfs4 port

playbooks/amazon.yml

@@ -1,4 +1,8 @@
 ---
+# Randomize Tor's ORPort and obfs4 port if Tor is enabled.
+# We do this early so ec2-security-group knows Tor's port
+- import_playbook: tor-setup.yml
+
 - name: Provision the EC2 Server
 # ==============================
   hosts: localhost

playbooks/azure.yml

@@ -1,4 +1,8 @@
 ---
+# Randomize Tor's ORPort and obfs4 port if Tor is enabled.
+# We do this early so azure-security-group knows Tor's port
+- import_playbook: tor-setup.yml
+
 - name: Provision the Azure Server (Resource Manager mode)
 # ========================================================
   hosts: localhost

playbooks/digitalocean.yml

@@ -1,4 +1,7 @@
 ---
+# Randomize Tor's ORPort and obfs4 port if Tor is enabled.
+- import_playbook: tor-setup.yml
+
 - name: Provision the DigitalOcean Server
 # =======================================
   hosts: localhost

playbooks/existing-server.yml

@@ -3,6 +3,9 @@
 # role to create a new server and instead applies Streisand to an existing
 # remote server.
 
+# Randomize Tor's ORPort and obfs4 port if Tor is enabled.
+- import_playbook: tor-setup.yml
+
 - name: Register the genesis role in use
   hosts: localhost
   gather_facts: yes

playbooks/google.yml

@@ -1,4 +1,8 @@
 ---
+# Randomize Tor's ORPort and obfs4 port if Tor is enabled.
+# We do this early so gce-network knows Tor's port
+- import_playbook: tor-setup.yml
+
 - name: Provision the GCE Server
 # =======================================
   hosts: localhost

playbooks/linode.yml

@@ -1,4 +1,7 @@
 ---
+# Randomize Tor's ORPort and obfs4 port if Tor is enabled.
+- import_playbook: tor-setup.yml
+
 - name: Provision the Linode Server
 # =================================
   hosts: localhost

playbooks/localhost.yml

@@ -2,6 +2,10 @@
 # localhost.yml is an advanced provisioning option that doesn't use a genesis
 # role to create a new server and instead applies Streisand to the localhost.
 
+# Randomize Tor's ORPort and obfs4 port if Tor is enabled.
+# We do this early so gce-network knows Tor's port
+- import_playbook: tor-setup.yml
+
 # Ensure Python is installed on the system
 - import_playbook: python.yml
 

playbooks/rackspace.yml

@@ -1,4 +1,7 @@
 ---
+# Randomize Tor's ORPort and obfs4 port if Tor is enabled.
+- import_playbook: tor-setup.yml
+
 - name: Provision the Rackspace Server
 # ====================================
   hosts: localhost

playbooks/roles/tor-bridge/defaults/main.yml

@@ -1,7 +1,7 @@
 ---
-tor_orport: 8443
-tor_obfs4_port: 9443
-
+tor_orport: "{{ lookup('file', lookup('env','HOME') + '/.streisand/tor-orport') or 0 }}"
+tor_obfs4_port: "{{ lookup('file', lookup('env','HOME') + '/.streisand/tor-obfs4-port') or 0 }}"
+tor_internal_hidden_service_port: 8181
 # By default Streisand does *not* publish the Tor relay's service descriptor to
 # the tor network. Using a value of 0 ensures the relay is private to the
 # streisand operator and their users. See the Tor documentation[0] for more

playbooks/roles/tor-bridge/vars/main.yml

@@ -18,4 +18,4 @@ tor_html_instructions: "{{ tor_gateway_location }}/index.html"
 
 tor_obfs4_qr_code: "{{ tor_gateway_location }}/tor-obfs4-qr-code.png"
 
-tor_internal_hidden_service_address: "127.0.0.1:8181"
+tor_internal_hidden_service_address: "127.0.0.1:{{ tor_internal_hidden_service_port }}"

playbooks/tor-setup.yml

@@ -0,0 +1,88 @@
+---
+# We randomize the Tor ORPort and obfs4 port fairly early
+# in the provisioning process to allow cloud firewalls/playbooks
+# to access the tor_orport and tor_obfs4_port variables
+# which are chosen randomly. Since we use ansible's "random" filter,
+# we run into issues of idempotence if we don't use set_fact to
+# make the call to "random". Even if we provide a seed, we
+# only get random-but-idempotent behavior within the ansible role.
+# Meaning the genesis-<cloud> roles would have a different number
+# for tor_orport and tor_obfs4_port than the number generated when
+# the tor-bridge role runs, even if we provide a fixed seed.
+
+# We randomize Tor's ORPort and obfs4 port to avoid being
+# easily fingerprinted as a Tor bridge (or a Streisand Tor bridge)
+# See https://lists.torproject.org/pipermail/tor-dev/2014-December/007957.html
+# and https://github.com/StreisandEffect/streisand/issues/101
+# for discussion/more data on the topic.
+- name: Randomize Tor's ORPort and obfs4 port
+  hosts: localhost
+  gather_facts: no
+  tasks:
+    - lineinfile:
+        path: "{{ lookup('env', 'HOME') }}/.streisand/tor-orport"
+        regexp: "^(.*)$"
+        state: absent
+
+    - lineinfile:
+        path: "{{ lookup('env', 'HOME') }}/.streisand/tor-obfs4-port"
+        regexp: "^(.*)$"
+        state: absent
+
+    - name: Randomize Tor's ORPort
+      run_once: true
+      lineinfile:
+        path: "{{ lookup('env', 'HOME') }}/.streisand/tor-orport"
+        regexp: "^[0-9]+$"
+        create: yes
+        # Pick a random port from list of available ports
+        line: "{{ tor_available_ports | random }}"
+
+    - name: Randomize Tor's obfs4 port
+      run_once: true
+      lineinfile:
+        path: "{{ lookup('env', 'HOME') }}/.streisand/tor-obfs4-port"
+        regexp: "^[0-9]+$"
+        create: yes
+        # The "reject" statement is to avoid using the same random port just chosen for tor_orport
+        line: "{{ tor_available_ports | reject('equalto', 'tor_orport') | list | random }}"
+
+
+  vars:
+    # Keep track of ports already being used by other services to avoid port conflicts
+    # "map" call is needed here because some of these vars are strings, others are integers
+    tor_unavailable_ports: "{{ [
+      nginx_port,
+      ssh_port,
+      le_port,
+      shadowsocks_server_port,
+      wireguard_port,
+      ocserv_port,
+      openvpn_port,
+      stunnel_remote_port,
+      cloudflared_port,
+      tor_internal_hidden_service_port
+    ] | map('int') | list }}"
+    # Choose a random port between 1024-32768--below 1024 would require elevated privileges,
+    # and any port above 32768 will be used as "Ephemeral Ports" by anything listening locally
+    # (see output of "cat /proc/sys/net/ipv4/ip_local_port_range" for the full range)
+    tor_random_port_range: "{{ range(1024, 32768) | list }}"
+    # Avoid the common ORPort and obfs4 ports
+    tor_common_ports: [9001, 8443, 9443]
+    # Calculate available ports by excluding common/used ports from our choices for randomization
+    tor_available_ports: "{{ tor_random_port_range | difference(tor_common_ports + tor_unavailable_ports) }}"
+
+  # These variable files are included so we can have a list of all
+  # used ports, this way we can avoid port conflicts when randomizing
+  # Tor's ORPort and obfs4 port.
+  vars_files:
+    - roles/openconnect/defaults/main.yml
+    - roles/openvpn/defaults/main.yml
+    - roles/shadowsocks/defaults/main.yml
+    - roles/ssh/defaults/main.yml
+    - roles/lets-encrypt/vars/main.yml
+    - roles/streisand-gateway/defaults/main.yml
+    - roles/stunnel/defaults/main.yml
+    - roles/cloudflared/defaults/main.yml
+    - roles/tor-bridge/defaults/main.yml
+    - roles/wireguard/defaults/main.yml