<commit_before>### or-ctl-filter - "control-port-filter" without the bash.
#### <NAME> (yawning at schwanenlied dot me)

or-ctl-filter is a Tor Control Port filter in the spirit of
["control-port-filter"](https://github.com/Whonix/control-port-filter) by the
Whonix developers.  It is more limited as the only use case considered is
"I want to run Tor Browser on my desktop with a system tor service and have
'about:tor' and 'New Identity' work while disallowing scary control port
commands".  But on a positive note, it's not a collection of bash and doesn't
call netcat.

Limitations/differences:
 * It only supports ControlSocket and not ControlPort.
 * It only supports NULL, COOKIE, and SAFECOOKIE authentication.
 * It does not lie about the SocksPort.
 * It does not limit request lenghts, because that's tor's problem, not mine.
 * It does not allow GETINFO inquries regarding tor's bootstrap process.
 * It expects the first command the application sends is AUTHENTICATE.

Commands allowed:
 * "GETINFO net/listeners/socks"
 * "SIGNAL NEWNYM"

Acknowledgements:
 * https://www.whonix.org/wiki/Dev/Control_Port_Filter_Proxy<commit_msg>Update the README a bit. (No functional changes)<commit_after>### or-ctl-filter - "control-port-filter" without the bash.
#### <NAME> (yawning at schwanenlied dot me)

or-ctl-filter is a Tor Control Port filter in the spirit of
["control-port-filter"](https://github.com/Whonix/control-port-filter) by the
Whonix developers.  It is more limited as the only use case considered is
"I want to run Tor Browser on my desktop with a system tor service and have
'about:tor' and 'New Identity' work while disallowing scary control port
commands".  But on a positive note, it's not a collection of bash and doesn't
call netcat.

Limitations/differences:
 * It only supports ControlSocket and not ControlPort.
 * It only supports NULL, COOKIE, and SAFECOOKIE authentication.
 * It does not lie about the SocksPort.
 * It does not limit request lengths, because that's tor's problem, not mine.
 * It does not allow GETINFO inquries regarding tor's bootstrap process.
 * It expects the first command the application sends is AUTHENTICATE.

Commands allowed:
 * "GETINFO net/listeners/socks"
 * "SIGNAL NEWNYM"

Example torrc:
```
# This requires the control port and cookie auth.
CookieAuthentication 1
CookieAuthFile /var/run/tor/control_auth_cookie
CookieAuthFileGroupReadable 1

# This requirs control port interaction over AF_UNIX.
ControlSocket /var/run/tor/control
ControlSocketsGroupWritable 1
```

How to run:
```
$ or-ctl-filter &
$ export TOR_SKIP_LAUNCH=1
$ export TOR_SOCKS_PORT=9050
$ start-tor-browser
```

I personally call `or-ctl-filter` from my openbox autostart file.  Bad things
will happen if multiple instances are ran at the same time since the control
port is hardcoded to what Tor Browser expects.

Acknowledgements:
 * https://www.whonix.org/wiki/Dev/Control_Port_Filter_Proxy
{'fraction_non_alphanumeric': 0.0790729379686435, 'fraction_numerical': 0.0027266530334014998, 'mean_word_length': 4.6226053639846745, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 4, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1234422', 'n_tokens_mistral': 892, 'n_tokens_neox': 845, 'n_words': 363}