<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><span></span></div><div><div></div><div><br></div><div><br>On 25 Jun 2018, at 02:41, procmem <<a href="mailto:procmem@riseup.net">procmem@riseup.net</a>> wrote:<br><br></div><blockquote type="cite"><div><span>Hello. We are trying to safely deal with programs that don't support Tor</span><br><span>DNS stream isolation so they don't pollute TransPort.</span><br></div></blockquote><div><br></div><div>We don't recommend TransPort for this reason. (See below.)</div><br><blockquote type="cite"><div><span>I've read the manual but it's not clear if you enable</span><br><span>IsolateClientProtocol by default. Is that the case?</span><br></div></blockquote><div><br></div>No, but you're probably looking for *Port isolation instead,</div><div>which is documented as on by default under SessionGroup:</div><div><br></div><div><span style="background-color: rgba(255, 255, 255, 0);">By default, streams received on different SocksPorts,</span></div><div><span style="background-color: rgba(255, 255, 255, 0);">TransPorts, etc are always isolated from one another.</span></div><div><span style="background-color: rgba(255, 255, 255, 0);">This option overrides that behavior.</span><div><a href="https://www.torproject.org/docs/tor-manual.html.en">https://www.torproject.org/docs/tor-manual.html.en</a></div><div><br></div><div>The other default isolation flags are documented in the man</div><div>page:</div><div>IsolateClientAddr and IsolateSOCKSAuth</div><div>There are also some internal flags that are always on:</div><div><a href="https://gitweb.torproject.org/tor.git/tree/src/or/or.h#n1673">https://gitweb.torproject.org/tor.git/tree/src/or/or.h#n1673</a></div><div><br></div><div>All the isolation flags that aren't named as defaults are not defaults.</div><br><blockquote type="cite"><div><span>Also if the former is enabled, do you have IsolateDest enabled for</span><br><span>DnsPort or not? If no then what is the rationale for this decision?</span><br></div></blockquote><div><br></div>I don't think IsolateDest makes sense for DNSPort. Building a</div><div>separate circuit for each DNS request is slow (for clients) and</div><div>expensive (for the network).</div><div><br></div><div>And regardless of isolation, resolving DNS addresses at a</div><div>different exit to the one that connects can cause privacy issues,</div><div>and it can result in slower connections.</div><div><br></div><div>So we recommend SOCKSPort or HTTPTunnelPort instead, because</div><div>they support sending DNS names to exits as part of the connection</div><div>request.</div><div><br></div><div>Here are a few general reasons for the defaults:</div><div><div><span style="background-color: rgba(255, 255, 255, 0);">* many applications expect to have a single source IP address</span></div><div><span style="background-color: rgba(255, 255, 255, 0);"> for </span><span style="background-color: rgba(255, 255, 255, 0);">all their connections, and</span></div></div><div><span style="background-color: rgba(255, 255, 255, 0);">* building a circuit for each destination is expensive, but</span></div><div>* isolating different users is important, so we automatically</div><div> isolate different source IP addresses, and automatically isolate</div><div> applications which have different socks usernames or passwords</div><div> (users or developers should configure each application with a</div><div> random socks username and password)</div><div><br></div><div>T</div><div><br></div></body></html>