The developers of the Tor project have released Arti 1.4.0, a Tor client implementation written in Rust. The 1.x branch is labeled as suitable for use by ordinary users, providing the same level of privacy, usability, and stability as the main implementation in C. Achieving parity with the C client is planned for the 2.0 branch. Once the Rust code reaches a level that can fully replace the C version, the developers intend to elevate Arti to the status of the main Tor implementation and gradually discontinue support for the C implementation. The code is distributed under the Apache 2.0 and MIT licenses.
Arti is originally developed as a modular, embeddable library that various applications can use. During the design of Arti, past experiences from Tor's development were taken into account, which helped to avoid known architectural problems related to the fact that the C implementation was initially designed as a SOCKS proxy and later adjusted for other needs.
In addition to modernizing the architecture, the reason for rewriting Tor in Rust was the desire to enhance code security by using a language that ensures safe memory handling. According to the Tor developers, using Rust without 'unsafe' blocks will prevent at least half of all typical vulnerabilities in the project. Furthermore, it is expected that Rust will speed up development due to the language's expressiveness and strict guarantees that allow avoiding redundant checks and unnecessary code writing.
In the new release, a new RPC interface has been finalized, replacing the control protocol via the TCP port defined by the ControlPort parameter. RPC can be used to integrate applications and services with Arti without embedding the Arti functionality library into the application.
Key differences of the new protocol:
- Use of the JSON format instead of a specific format requiring its own parser;
- Ease of protocol extension. Formalization of how the client and server should handle unsupported messages, parameters, and data;
- A mechanism to determine the availability of RPC;
- Support for simultaneous transmission of multiple requests over a single network connection;
- The availability of ready-made client libraries for C, Python, and Rust.
Other changes in Arti 1.4.0 include preparatory work to support relays and the continued implementation of features to protect onion services from DDoS attacks.
Source: opennet.ru
