Minimize the differences between both v3 and other descriptors. Currently Onionbalance v3 descriptors can look different from other descriptors, which makes it possible for clients and HSDirs to learn that a service is using Onionbalance. This can be an issue for more advanced onion service threat models. .

Onionbalance for v3 onions does not support distinct descriptor mode right now, which means that it's currently restricted to a limit of 8 backend instances.

Here is how distinct descriptor mode should work:

• Onionbalance should accept any number of backend instances.
• Onionbalance should calculate how many HS descriptors are needed to fit those backend instances (let's say N subdescriptors are needed)
• Onionbalance should calculate a descriptor publish schedule so that all those N subdescriptors are published at regular intervals.
• Onionbalance should continue updating and re-uploading its subdescriptors as normal.

There are other possible shortcuts and optimizations that we could take but this is the basic logic here. Also, note that it's important the subdescriptors are published with optimal gaps between them so that clients will have an equal chance of reaching each backend instance.

[Updated 12/03/2021]

So all was running just fine:

2020-04-07 15:16:28,097 [INFO]: Initialized hash ring of size 3894 (blinded key: b'S6Vj3CykF/tcJdl7Gzz3PORZEsC8sF7JHgeR46G7ogA=')
2020-04-07 15:16:28,098 [INFO]: Getting HS index with TP#18359 for second descriptor (1 replica)
2020-04-07 15:16:28,099 [INFO]: Tried with HS index f89fa7cb8c67b87ec948300504417586f62e287c055525656c4fe099b42cf94a got position 3788
2020-04-07 15:16:28,101 [INFO]: Getting HS index with TP#18359 for second descriptor (2 replica)
2020-04-07 15:16:28,102 [INFO]: Tried with HS index c2771648cf7eaa66e409366dfd19de8e2d8967c0ea682d81b730b30204553c30 got position 2959
2020-04-07 15:16:28,103 [INFO]: HSDir set remained the same
2020-04-07 15:16:28,105 [INFO]: No reason to publish second descriptor for 5tqw3kwwuy7sf3zhdpvz6valtyjnbsuxasx52afnuezr6hkmbsnqrtad.onion

Did a restart on the Tor process (reload / SIGHUP do not trigger this bug)to downgrade to info log level, and:

2020-04-07 15:20:39,391 [INFO]: [] fetch_instance_descriptors() called []
Traceback (most recent call last):
File "/usr/local/bin/onionbalance", line 11, in
load_entry_point('OnionBalance==0.1.9', 'console_scripts', 'onionbalance')()
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9-py3.7.egg/onionbalance/manager.py", line 31, in main
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9-py3.7.egg/onionbalance/hs_v3/manager.py", line 43, in main
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9-py3.7.egg/onionbalance/common/scheduler.py", line 102, in run_forever
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9-py3.7.egg/onionbalance/common/scheduler.py", line 79, in _run_job
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9-py3.7.egg/onionbalance/common/scheduler.py", line 45, in run
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9-py3.7.egg/onionbalance/hs_v3/onionbalance.py", line 111, in fetch_instance_descriptors
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9-py3.7.egg/onionbalance/hs_v3/stem_controller.py", line 56, in mark_tor_as_active
File "/usr/local/lib/python3.7/dist-packages/stem-1.8.0-py3.7.egg/stem/control.py", line 3823, in signal
response = self.msg('SIGNAL %s' % signal)
File "/usr/local/lib/python3.7/dist-packages/stem-1.8.0-py3.7.egg/stem/control.py", line 662, in msg
self._socket.send(message)
File "/usr/local/lib/python3.7/dist-packages/stem-1.8.0-py3.7.egg/stem/socket.py", line 460, in send
self._send(message, lambda s, sf, msg: send_message(sf, msg))
File "/usr/local/lib/python3.7/dist-packages/stem-1.8.0-py3.7.egg/stem/socket.py", line 243, in _send
raise stem.SocketClosed()
stem.SocketClosed

Shouldn't onionbalance daemon be somewhat resistant to Tor process restarts or reloads? Like when Tor process is not running or not responding shout a warning about it, but recover when it becomes available or responsive again.

Why we need to be resilient for restarts / reloads and Tor lack of response?

• vanguards addon (changing layer 2 and layer 3 nodes);
• various changes in torrc that hosts the frontend, that require on-the-fly appliance;
• too many events on ControlPort overwhelm it, so onionbalance should peacefully wait until it works

Of course is under optimal for onionbalance to start without a working ControlPort at all and just print useless warnings, so the patch should be that at start time, if it has no communication with the Tor daemon die and log why (we already do this). But in case communication with Tor daemon is lost while running smoothly, wait for it to come back and issue often warnings.

Allow operators to migrate their onion service from tor to onionbalance.

This means that we need to parse the v3 private key and make it into an onionbalance private key. Let's hope that the ed25519 private key formats don't prove too complicated here.

Similar to how v2 mode has: https://onionbalance-v3.readthedocs.io/en/latest/v2/design.html#choice-of-introduction-points

Identical to DonnchaC/onionbalance#24

Patches welcome.

To sanitize and filter config file as much as possible, users should be prevented from accidentally nominating the frontend onion address as a backend instance as well.

If Loaded instance HS-v3-address.onion matches (at least one) element in instances it should print a config file [ERROR] and exit.

Most probably when #17 was merged, to support native Tor v3 onion secret keys, the previously onionbalance-config generated v3 onion secret keys cannot be loaded any more. Fails with:

[WARNING]: Service private key not in Tor format either ('Tor key does not start with Tor header'). Aborting.

There is currently a hardlimit in initialize_services_from_config_data() but supporting more than one service should not be too hard.

Opening a ticket with all the tweaks we need to do in PR #17 (all UI related) so we can track changes in the new onionbalance release. When these are addresses PR #17 can be merged to master.

1. Entering a path to a Tor v3 onion service private key does not work (from PR #17 ):

Traceback (most recent call last):
File "/usr/local/bin/onionbalance-config", line 11, in
load_entry_point('OnionBalance==0.1.9+14.g5864dfc', 'console_scripts', 'onionbalance-config')()
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/config_generator/config_generator.py", line 446, in main
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/config_generator/config_generator.py", line 40, in init
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/config_generator/config_generator.py", line 58, in gather_information
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/config_generator/config_generator.py", line 143, in load_master_key
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/config_generator/config_generator.py", line 167, in load_v3_master_key
NotImplementedError

2. onionbalance-config should be able to interrupt cleanly, discard any temporary configuration file (in case it was not saved yet) so the user can start over in case of a typo (from PR #17 ). Currently at interrupt we get:

Traceback (most recent call last):
File "/usr/local/bin/onionbalance-config", line 11, in
load_entry_point('OnionBalance==0.1.9+14.g5864dfc', 'console_scripts', 'onionbalance-config')()
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/config_generator/config_generator.py", line 446, in main
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/config_generator/config_generator.py", line 40, in init
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/config_generator/config_generator.py", line 50, in gather_information
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/config_generator/config_generator.py", line 99, in get_output_path
KeyboardInterrupt

3. Do not require for the entire DIRECTORY where oninobalance-config will store the configuration file to be totally empty. From PR #17

If one wants to put the Tor migrated hs_ed25519_secret_key inside the same directory with the config file, something totally normal and clean for anyone, it does not work. It says:
[ERROR]: The specified output directory 'config/' is not empty. Please delete any files and folders or specify another output directory.

onionbalance-config should not care if the folder where the user wants to store the configuration file is totally empty. Maybe one wants to set it in /var/lib/tor. So, it should only care if it finds a config.yaml file in the path provided as config path, not just any file or directory already existing in that path. It should only say something like:
"Path already contains a config.yaml file. This is likely to be a configuration file. Please check and remove it in order to proceed"

There is currently no status socket support for v3. We need to implement this since people seem to use it. Patches welcome.

Support client authorization on the frontend service. This may be needed in specialized use cases. Adding this feature would first require implementing client authorization support to Stem v3 descriptors and then using that feature in Onionbalance.

Good day, i have problem with current domain key, when import inside onion balance.

[WARNING]: Service private key not in OBv3 format ('('Could not deserialize key data. The data may be in an incorrect format or it may be encrypted with an unsupported algorithm.', [_OpenSSLErrorWithText(code=151584876, lib=9, reason=108, reason_text=b'error:0909006C:PEM routines:get_name:no start line')])'). Trying tor's format...

but key i get from current instance.
inside hs_keys dir, 3 files.

hostname 
hs_ed25519_public_key
hs_ed25519_secret_key

Tor 0.4.6.8
onionbalance 0.2.2

Hi.
Is it possible to use new OB version in mixed mode: master address V2 and backends V3?

I cloned this git repo and installed all dependencies (python 3.8.1). My pip3 list looks like this:

Package      Version
------------ -------
future       0.18.2 
pip          20.0.2 
pycrypto     2.6.1  
PyYAML       5.3    
setproctitle 1.1.10 
setuptools   41.2.0 
stem         1.8.0

Now when I try python3 setup.py install I get this error:

Traceback (most recent call last):
  File "setup.py", line 16, in <module>
    exec(init_file.read(), module_info)
  File "<string>", line 9, in <module>
KeyError: "'__name__' not in globals"

After successfully building second descriptor and trying to upload it to 8 HSDirs, 1/8 failed with the following message:

[WARNING]: Descriptor action failed for unknown service 5tqw3kwwuy7sf3zhdpvz6valtyjnbsuxasx52afnuezr6hkmbsnqrtad to $51E1CF613FD6F9F11FE24743C91D6F9981807D82~torpidsDEisppro3

As per chat, the suspect is:

if self._address_is_instance(desc_event.address): logger.info("Description fetch failed for instance %s to %s", desc_event.address, desc_event.directory) elif self._address_is_frontend(desc_event.address): logger.warning("Descriptor upload failed for frontend %s to %s", desc_event.address, desc_event.directory) else: logger.warning("Descriptor action failed for unknown service %s to %s", desc_event.address, desc_event.directory)

This is not something serious though, as the frondend is still up and the onionbalance daemon is not killed, but worth fixing. On super heavy loads is quite easy to catch a HSDir to which the upload of the descriptor would fail, so need to improve little bit.

The code from Pull Request #42 has disabled pylint Convention, Warnings and Refactoring messages due to the large numbers, which lead to exit code 28 Device out of memory on our Travis CI builds.

However, it's worth going through and fixing the Warning messages to ensure better code quality that remains more maintainable.

To do this, pylist calls will have to reenable Warning messages.

Pycrypto is no longer maintained and Pycryptodome[1] provides a drop-in replacement.

[1] https://www.pycryptodome.org/en/latest/index.html
Related: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=971316

This is a master ticket just to keep track of what was already done and what is left to do before we tag 0.2.0.

• Support Tor HSv3 private key file format: Now you can migrate your existing v3 onion service to onionbalance. Fixes #10 --- this still needs #24 to be fixed;

• Do not crash while running if at least 1 (one) backend instance is still running fine. This should protect the frontend from some attacks. Fixes #20

• Do not crash while running if communication with Tor control port stops suddenly or becomes too slow to use, wait for it to come back. Fixes #15

• The configuration file can now be changed on the fly and reloaded by sending a SIGHUP to the onionbalance process. Fixes #19

• Improve log messages and add some more diagnostics for descriptor uploads results. Fixes #16

• Other documentation improvementst and small fixes for onionbalance-config interactive configuration file generator. Fixes #22, #24

• Minor additional checks for the config file before we start up. Fixes #26, #27

• Status socket support for v3 onion services. Fixes #18 --- if we can cherry pick something here OK, otherwise we can leave #18 for the next release, not a blocker*

Greetings George.
Trying to run onionbalance, v3_dev_wip branch. Got errors:

Traceback (most recent call last):
File "/usr/local/bin/onionbalance", line 11, in
load_entry_point('OnionBalance==0.1.8', 'console_scripts', 'onionbalance')()
File "/usr/lib/python2.7/dist-packages/pkg_resources/init.py", line 480, in load_entry_point
return get_distribution(dist).load_entry_point(group, name)
File "/usr/lib/python2.7/dist-packages/pkg_resources/init.py", line 2693, in load_entry_point
return ep.load()
File "/usr/lib/python2.7/dist-packages/pkg_resources/init.py", line 2324, in load
return self.resolve()
File "/usr/lib/python2.7/dist-packages/pkg_resources/init.py", line 2330, in resolve
module = import(self.module_name, fromlist=['name'], level=0)
ImportError: No module named onionbalance.hs_v2.manager

PYTHONPATH=. http_proxy='http://127.0.0.1:9/' python3 -m sphinx -N -v -v -v -v -E -bhtml docs/ docs/_build/html fails with sphinx 1.8.5-7 on Debian with ImportError: No module named onionbalance.config_generator.config_generator

If sphinxcontrib.autoprogram is removed from conf.py it works

I followed the Onion V3 guide and i get this error when i add "HiddenServiceOnionBalanceInstance 1" in my torrc backend server.
Error Log
host systemd[1]: Starting Anonymizing overlay network for TCP...
host tor[]: [notice] Tor 0.4.3.4-rc running on Linux with Libevent 2.1.8-stable, OpenSSL 1.1.1d, Zlib 1.2.11, Liblzma 5.2.4, and Libzstd 1.3.8.
host tor[]: [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
host tor[]: [notice] Read configuration file "/usr/share/tor/tor-service-defaults-torrc".
host tor[]: [notice] Read configuration file "/etc/tor/torrc".
host tor[]: May 09 15:40:56.117 [notice] Included configuration file or directory at recursion level 2: "/usr/local/etc/torrc.d/".
host tor[]: [notice] Included configuration file or directory at recursion level 1: "/etc/torrc.d/".
host tor[]: [warn] Failed to parse/validate config: Unknown option 'HiddenServiceOnionBalanceInstance'. Failing.
host tor[]: [err] Reading config failed--see warnings above.
host systemd[1]: [email protected]: Control process exited, code=exited, status=1/FAILURE
host systemd[1]: [email protected]: Failed with result 'exit-code'.
host systemd[1]: Failed to start Anonymizing overlay network for TCP.
host systemd[1]: [email protected]: Service RestartSec=100ms expired, scheduling restart.
host systemd[1]: [email protected]: Scheduled restart job, restart counter is at 5.
host systemd[1]: Stopped Anonymizing overlay network for TCP.
host systemd[1]: [email protected]: Start request repeated too quickly.
host systemd[1]: [email protected]: Failed with result 'exit-code'.
host systemd[1]: Failed to start Anonymizing overlay network for TCP.

If backend instances do not set HiddenServiceOnionbalanceInstance 1 in their torrc, onionbalance is killed:

Traceback (most recent call last):
File "/usr/local/bin/onionbalance", line 11, in
load_entry_point('OnionBalance==0.1.9+14.g5864dfc', 'console_scripts', 'onionbalance')()
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/manager.py", line 31, in main
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/hs_v3/manager.py", line 40, in main
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/common/scheduler.py", line 87, in run_all
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/common/scheduler.py", line 79, in _run_job
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/common/scheduler.py", line 45, in run
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/hs_v3/onionbalance.py", line 162, in publish_all_descriptors
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/hs_v3/service.py", line 238, in publish_descriptors
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/hs_v3/service.py", line 306, in _publish_descriptor
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/hs_v3/hashring.py", line 216, in get_responsible_hsdirs
AssertionError

This should be addressed to:

• if ALL backend instances are buggy configured, warn heavily that we cannot publish descriptors for the frontend service, because the backend instances are not functioning properly.

• continue running but warn heavily if just one (or more, but not ALL) backend instances do not set their HiddenServiceOnionbalanceInstance 1 torrc line. Otherwise, if one backend is compromised for example, it can make the frontend unavaialble (regardless the other backend instances are functioning properly) until someone notices and changes manually.

I finished setting up backend instances and made config.yaml ready. Now when I run python3 onionbalance.py -v info -p 9051 I get this error:

2020-02-07 23:26:39,675 [WARNING]: Initializing onionbalance (version: 0+untagged.189.g7a19118)...
2020-02-07 23:26:39,682 [INFO]: Loaded the config file '../onionbalance/config.yaml'.
Traceback (most recent call last):
  File "onionbalance.py", line 10, in <module>
    onionbalance.hs_v3.manager.main()
  File "../onionbalance/onionbalance/hs_v3/manager.py", line 35, in main
    my_onionbalance.init_subsystems(args)
  File "../onionbalance/onionbalance/hs_v3/onionbalance.py", line 44, in init_subsystems    self.consensus = ob_consensus.Consensus()
  File "../onionbalance/onionbalance/hs_v3/consensus.py", line 36, in __init__
    self.refresh()
  File "../onionbalance/onionbalance/hs_v3/consensus.py", line 42, in refresh
    md_consensus_str = my_onionbalance.controller.get_md_consensus().encode()
  File "../onionbalance/onionbalance/hs_v3/stem_controller.py", line 54, in get_md_consensus
    return self.controller.get_info("dir/status-vote/current/consensus-microdesc")
  File "../onionbalance/obenv/lib/python3.8/site-packages/stem/control.py", line 489, in wrapped
    return func(self, *args, **kwargs)
  File "../onionbalance/obenv/lib/python3.8/site-packages/stem/control.py", line 1209, in get_info
    stem.response.convert('GETINFO', response)
  File "../onionbalance/obenv/lib/python3.8/site-packages/stem/response/__init__.py", line 124, in convert
    message._parse_message(**kwargs)
  File "../onionbalance/obenv/lib/python3.8/site-packages/stem/response/getinfo.py", line 44, in _parse_message
    raise stem.InvalidArguments('552', 'GETINFO request contained unrecognized keywords: %s\n' % ', '.join(unrecognized_keywords), unrecognized_keywords)
stem.InvalidArguments: GETINFO request contained unrecognized keywords: dir/status-vote/current/consensus-microdesc

When I run the onionbalance I just installed with setup.py like onionbalance -v info -p 9051 I get a different error:

2020-02-07 23:28:35,232 [INFO]: Loaded the config file '../onionbalance/config.yaml'.
Traceback (most recent call last):
  File "../onionbalance/obenv/bin/onionbalance", line 11, in <module>
    load_entry_point('OnionBalance==0+untagged.189.g7a19118', 'console_scripts', 'onionbalance')()
  File "../onionbalance/obenv/lib/python3.8/site-packages/OnionBalance-0+untagged.189.g7a19118-py3.8.egg/onionbalance/hs_v2/manager.py", line 56, in main
NameError: name 'tor_socket' is not defined

It looks like that the installed onionbalance is using hs_v2 not hs_v3.

paramiko was not mentioned in https://lists.torproject.org/pipermail/tor-dev/2020-January/014142.html as a dependency. If you try to run onionbalance without paramiko you'll end up with this error:

Traceback (most recent call last):
  File "onionbalance.py", line 7, in <module>
    import onionbalance.hs_v3.manager
  File "../onionbalance/onionbalance/hs_v3/manager.py", line 13, in <module>
    from onionbalance.hs_v3 import onionbalance
  File "../onionbalance/onionbalance/hs_v3/onionbalance.py", line 12, in <module>
    from onionbalance.hs_v3 import hashring
  File "../onionbalance/onionbalance/hs_v3/hashring.py", line 7, in <module>
    from cryptography.hazmat.primitives import serialization
ModuleNotFoundError: No module named 'cryptography'

I solved the issue by issuing pip3 install paramiko.

Hi, I just wanted to inform you I'd like to test v3 onionbalance and you can count on it, but I'm very busy this week. I'll set up as soon as I get some spare time.

Thanks for all your efforts

Right now, if onionbalance is missing - instances from the config file, it will correctly exit:

[WARNING]: Initializing onionbalance (version: 0.1.9+14.g5864dfc)...
[ERROR]: Config file is bad. 'instances' is missing. Did you make it with onionbalance-config?

But in case we have - instances set, but no data under it (no address / name parameters) it won't exit with an "[ERROR] Config file is bad. No backend instances are set. Onionbalance needs at least 1". instead:

Traceback (most recent call last):
File "/usr/local/bin/onionbalance", line 11, in
load_entry_point('OnionBalance==0.1.9+14.g5864dfc', 'console_scripts', 'onionbalance')()
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/manager.py", line 31, in main
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/hs_v3/manager.py", line 27, in main
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/hs_v3/onionbalance.py", line 42, in init_subsystems
File "/usr/local/lib/python3.7/dist-packages/OnionBalance-0.1.9+14.g5864dfc-py3.7.egg/onionbalance/hs_v3/onionbalance.py", line 95, in load_config_file
TypeError: 'NoneType' object is not iterable

We used to have a nice suite of v2 and v3 Chutney tests but those broke when Chutney got updated. We should fix the Chutney scripts to work again and revive those tests (and maybe write some more).

Relevant commit: 8904178

As we describe in the documentation currently we can use up to 8 backend instances. If this will be increased in the future it's quite possible but for the time being, wouldn't it make sense to limit the number of backend instances the user can enter in both onionbalance-config interactive mode, and -n parameter in command line? Right not onionbalance-config will happily accept for Number of instances to create 20000, and it only states the default value [2], makes sense to specify: Number of instances to create (min. 1 max. 8) [2]: or something similar. What do you think?

I just read through much of the docs but still have the following fundamental question: what does onionbalance do that can't be done by HAProxy running as an onion service that load balances across several backend servers also running as their own onion services?

Thanks!

tox is used by our setup scripts and CI config but it actually doesn't really offer much and substantially increases complexity of the setup. Let's kill it with fire.

As part of this ticket we should remove tox from being a requirement to run the unittests, and instead run them without tox. AFAIK most python projects don't use tox so it shouldn't be a problem to get our tests to work.