<HTML><BODY>H<br><br>Mon, 31 Mar 2014 12:38:01 -0400 от Nick Mathewson <nickm@alum.mit.edu>:<br>
<blockquote style="border-left:1px solid #0857A6; margin:10px; padding:0 0 0 10px;"><div id=""><div class="js-helper js-readmsg-msg"><div><div id="style_13962838940000000224_BODY">On Thu, Mar 27, 2014 at 7:35 AM, Harry SeventyOne <<a href="/compose?To=harry71@bk.ru">harry71@bk.ru</a>> wrote:<br>
> Hi,<br>
><br>
> I've written this (ugly, unconfigurable) patch for Tor which is designed to<br>
> allow hidden services more information about their users, by giving each<br>
> inbound circuit its own temporary "IP address" in the 127.x range. This<br>
> technique works on Linux (I've not tried it on anything else) and allows the<br>
> application server to do some useful things which were previously difficult:<br>
><br>
> * Identify TCP connections coming from the same client, in a short space of<br>
> time, for example, for diagnostic log analysis, identifying traffic trends<br>
> * Rate-limit operations coming from the same client, to defend against some<br>
> types of DoS attacks<br>
> * Temporarily block abusive clients (at least, until they make a new Tor<br>
> circuit)<br>
><br>
> More importantly, it can do this with an unmodified application-server (e.g.<br>
> web servers typically have these features built-in) because it effectively<br>
> "spoofs" the client ID as an ip-address, in the 127.x range.<br>
><br>
> The patch is currently not configurable (the feature can't be turned off).<br>
> It only works with hidden services which are routed to "localhost".<br>
><br>
> Request for comments. What do you think?<br><br>
Hi, Harry!<br><br>
I like the idea of this feature, though really only the first<br>
application makes sense to me. (The other two seem like they'd just<br>
move DoS from one part of the protocol stack to another.) Are there<br>
other applications here, or ?</div></div></div></div></blockquote>I'm not completely sure what applications exist. My experiments have shown that it's of some value in tracking clients, it certainly makes it easier to interpret web server access-logs.<br><br>The DoS angle only works against certain types of DoS, including perhaps some unintended DoS - such as robots or mirroring software which hits the server too fast, and needs to be rate-limited.<br><br>I can see that a lot of work would probably be requires to make it work for the trunk of Tor, including the IPv6 work. I'm not completely sure whether I could do that.<br><br>I wonder if there is a better proxy for the "client temporary identity" than circuit-id, and where we can get it from (in Tor's internal data-structure)?<br><br>Circuit IDs certainly do get reused, but in my experience, not very quickly on low-traffic sites. This makes the logs make more sense, certainly to humans and possibly to log-analysis software.<br><br style="overflow: auto;" dir="ltr" id="tinymce" class="mceContentBody " onload="window.parent.tinyMCE.get('compose_390_composeEditor').onLoad.dispatch();" contenteditable="true"><blockquote style="border-left:1px solid #0857A6; margin:10px; padding:0 0 0 10px;"><div id=""><div class="js-helper js-readmsg-msg"><div><div id="style_13962838940000000224_BODY">* It's better to do a patch like this against git master; Tor 0.2.4 is<br>
not going to get any new features.</div></div></div></div></blockquote><br>But for users who want to try out the patch "right now", possibly on a production server, a patch against the stable release is more useful :)<br><br>Thanks for your helpful comments!<br><br>Harry<br></BODY></HTML>