gen_tor_client_auth

#!/usr/bin/env python3

"""
https://tor.stackexchange.com/questions/19221/how-to-setup-client-authorization-for-v3-onion-services
https://github.com/AnarchoTechNYC/meta/wiki/Connecting-to-an-authenticated-Onion-service#procedure-for-version-3-onion-services

Python-Script from AnarchoTechNYC:
https://github.com/AnarchoTechNYC/ansible-role-tor/blob/master/molecule/default/scripts/tor-auth-x25519-gen.py
"""


from base64 import b32encode, b64decode
from pathlib import Path
from subprocess import run
from tempfile import TemporaryDirectory
from typing import NamedTuple
from urllib.parse import urlparse


class ClientAuth(NamedTuple):
    private: str
    public: str


def gen_client_keypair(onion_url: str) -> ClientAuth:

    host = urlparse(onion_url).hostname
    if host is None or not host.endswith(".onion"):
        raise ValueError("Only onion urls can use tor client auth")
    else:
        host, _ = host.split(".", maxsplit=1)

    with TemporaryDirectory() as directory:
        private_key = Path(directory, "private-key.pem")
        public_key = Path(directory, "public-key.pem")
        run(["openssl", "genpkey", "-algorithm", "x25519", "-out", private_key])
        run(
            [
                "openssl",
                "pkey",
                "-in",
                private_key,
                "-pubout",
                "-outform",
                "PEM",
                "-out",
                public_key,
            ]
        )
        private_key = b32encode(
            b64decode(private_key.read_text().splitlines()[1])
        ).decode()[:-4]
        public_key = b32encode(
            b64decode(public_key.read_text().splitlines()[1])
        ).decode()[:-4]
        return ClientAuth(
            f"{host}:x25519:{private_key}",
            f"descriptor:x25519:{public_key}",
        )


onion_url = input("Onion-URL: ")
try:
    key_pair = gen_client_keypair(onion_url)
except ValueError as e:
    raise SystemExit(e.args[0])

with (
    open("client.auth_private", "w") as fd_priv,
    open("client.auth", "w") as fd_pub,
):
    fd_priv.write(key_pair.private)
    fd_pub.write(key_pair.private)

print("Saved keys as `client.auth_private` and `client.auth`")
print("client.auth_private:", key_pair.private)
print("client.auth: ", key_pair.public)