- anti-censorship-team - lists.torproject.org

Reboot of Snowflake VPSes is needed
by David Fifield 28 Oct '21

28 Oct '21

I got an email saying that the snowflake bridge and broker VPSes need to be restarted to migrate them to a new storage backend. If we don't do it, it will happen automatically some time next week. Is there a better time to schedule the restart? ----- Forwarded message from "eclips.is" <support(a)eclips.is> ----- Date: Wed, 27 Oct 2021 11:52:08 +0000 From: "eclips.is" <support(a)eclips.is> Dear eclips.is user, We are performing an update on our virtualization platform, this requires a change in the configuration of the storage backend. Due to this update your VPS needs to be stopped/started. We will execute this for you next week. If you prefer to plan this on your own, please feel free to stop/start your VPS yourself. By doing so, the VPS will be moved to the updated platform. Note: A reboot from within the machine itself will not be sufficient. ----- End forwarded message -----

2 1

configure router NAT for snowflake proxy
by meskio 25 Oct '21

25 Oct '21

Hello, I thought I could host a snowflake standalone proxy in my home fiber. Following the instructions[0] it says that is "especially recommended": > A full-cone NAT (you can use this NAT behaviour tool to test what type of NAT > you have. The properties you are looking for are address-independent mapping > and either address-independent or address-dependent filtering) Using the "NAT behaviour tool" I get: * NAT mapping behavior: endpoint independent (good) * NAT filtering behavior: address and port dependent (bad) My home router is an openwrt on which I have total control, it gets the public IP from my ISP and provides NAT to my home network. I tried playing a bit with the NAT Rules and the firewall settings, but all that is magic for me. Any tips how to fix the NAT filtering in openwrt or what do I need to look into iptables for it? Thanks. [0] https://community.torproject.org/relay/setup/snowflake/standalone/ -- meskio | https://meskio.net/ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- My contact info: https://meskio.net/crypto.txt -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Nos vamos a Croatan.

1 0

SCTP-Based Pluggable Transport Prototype
by Alexander Mages 18 Sep '21

18 Sep '21

Hello Anti-Censorship Team, I was advised by Cecylia to share my project with this mailing list for the wider community to see and critique. For the past couple of months, I have been doing research under the advisory of Prof. Eugene Vasserman (CC) at Kansas State University, and this project is the result. I intend to continue working on privacy and anonymity, so if this project has potential I would be happy to keep working on it, as well as exploring other ways to contribute. The concept for this transport was derived from this wiki page: https://gitlab.torproject.org/legacy/trac/-/wikis/doc/PluggableTransports/i… . The transport is functional but not yet tested with the Tor Browser. I prototyped this transport using Ncat for SCTP and Telnet for TCP. It is written in Python 3 and SCTP functionality was implemented using C/POSIX-like socket parameters, removing the necessity of a third-party library. A write-up attached to this email denotes functionality, dependencies, limitations, and instructions for running the transport. I look forward to hearing everyone's thoughts! Regards, Alex Mages

2 3

ansible role - snowflake - updates
by Jacobo Nájera 27 Aug '21

27 Aug '21

Hello, I added new features to the ansible role of snowflake: - Support for: Debian Bullseye and Ubuntu Focal - Variable to update the standalone version of Snowflake If you are using the ansible role you can update snowflake via your playbook. First, upgrade ansible role ansible-galaxy install -f nvjacobo.snowflake Then add snowflake_update var: - hosts: all vars: snowflake_update: yes roles: - nvjacobo.snowflake Finally run your playbook. Documentation of ansible role snowflake: https://www.jacobo.org/en/ansible-for-snowflake-proxies-of-the-tor-network/ Thanks, Jacobo

1 0

Improving Snowflake performance by adjusting smux parameters
by David Fifield 04 Aug '21

04 Aug '21

While experimenting with another tunnel built on KCP and smux, I discovered that performance could be greatly increased by increasing the size of smux buffers. It's likely that doing the same can also improve performance in Snowflake. There are two relevant parameters, MaxReceiveBuffer and MaxStreamBuffer. MaxStreamBuffer seems to be the most important one to increase. https://pkg.go.dev/github.com/xtaci/smux#Config // MaxReceiveBuffer is used to control the maximum // number of data in the buffer pool MaxReceiveBuffer int // MaxStreamBuffer is used to control the maximum // number of data per stream MaxStreamBuffer int The default values are 4 MB and 64 KB. https://github.com/xtaci/smux/blob/eba6ee1d2a14eb7f86f43f7b7cb3e44234e13c66… MaxReceiveBuffer: 4194304, MaxStreamBuffer: 65536, kcptun, a prominent KCP/smux tunnel, has defaults of 4 MB (--smuxbuf) and 2 MB (--streambuf) in both client and server: https://github.com/xtaci/kcptun/blob/9a5b31b4706aba4c67bcb6ebfe108fdb564a90… In my experiment, I changed the values to 4 MB / 1 MB on the client and 16 MB / 1 MB on the server. This change increased download speed by about a factor of 3: default buffers 477.4 KB/s enlarged buffers 1388.3 KB/2 Values of MaxStreamBuffer higher than 1 MB didn't seem to have much of an effect. 256 KB did not help as much. My guess, based on intuition, is that on the server we should set a large value of MaxReceiveBuffer, as it is a global limit shared among all clients, and a relatively smaller value of MaxStreamBuffer, because there are expected to be many simultaneous streams. On the client, don't set MaxReceiveBuffer too high, because it's on an end-user device, but go ahead and set MaxStreamBuffer high, because there's expected to be only one or two streams at a time. I discovered this initially by temporarily settings smux to protocol v1 instead of v2. My understanding is that v1 lacks some kind of receive window mechanism that v2 has, and by default is more willing to expend memory receiving data. See "Per-stream sliding window to control congestion.(protocol version 2+)": https://pkg.go.dev/github.com/xtaci/smux#readme-features Past performance ticket: "Reduce KCP bottlenecks for Snowflake" https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snow…

3 5

Snowflake in action
by Jacobo Nájera 14 Jul '21

14 Jul '21

Hi, I wrote about my experience running snowflake proxies by standalone version. I did an analysis about hardware resources and standalone version by 4 setups. Spanish: https://www.jacobo.org/ansible-snowflake/ English: https://www.jacobo.org/en/snowflake-in-action/ More analysis soon. Thanks, Jacobo

1 0

Do we expect to have as many standalone Snowflake proxies as we do?
by David Fifield 08 Jul '21

08 Jul '21

I was looking at https://snowflake-broker.torproject.net/debug just now, and saw: current snowflakes available: 317 standalone proxies: 216 browser proxies: 0 webext proxies: 101 unknown proxies: 0 NAT Types available: restricted: 278 unrestricted: 2 unknown: 37 About 2/3 of proxies are standalone, which is more than I would have supposed. Has there been word getting out about how to run one, or something?

5 4

Question about running a snowflake proxy
by Matthew Finkel 29 Jun '21

29 Jun '21

Dropping this here in case anyone wants to answer them: https://blog.torproject.org/comment/292032#comment-292032 I'm assuming they are referring to running a standalone proxy along with obfs4proxy.

2 1

snowflake proxy operation
by Jacobo Nájera 23 Jun '21

23 Jun '21

Hi, Since the end of March I have been operating 4 snowflake proxies. So I would like to share my experience on snowflake proxy operation in numbers. Now I am looking for a reliable mechanism or method to update snowflake versions. Software details - Xen paravirtualization - Debian buster - Ansible snowflake role (https://galaxy.ansible.com/nvjacobo/snowflake) Hardware details 1. 3072 MiB (2 cores) 2. 1024 MiB (1 cores) 3. 512 MiB (1 core) 4. 512 MiB (1 core) Traffic statistics Bandwidth by proxies 1. 48.83 GiB 2. 48.83 GiB 3. 36.73 GiB 4. 28.00 GiB More details (snowflake-vnstat.txt attached) Thanks, Jacobo

2 2

Our findings from the Snowflake User Survey
by Duncan Larsen-Russell 24 May '21

24 May '21

Hi everyone, At the beginning of March we launched a social media campaign to recruit more testers of Snowflake on Tor Browser Alpha, with the intention of stress-testing the system as traffic is amped up. To collect feedback in a slightly more structured manner, the Anti-Censorship team designed a survey which ran on our LimeSurvey instance (survey.torproject.org) for the month of March and a little into April. The response was amazing, and we got over 700 submissions from Snowflake users. A lot of it involved qualitative, freeform feedback too – which isn't included in the report to protect the privacy of our participants – but has been received and read by both the Anti-Censorship and UX teams at Tor (and we're very grateful for it!). I won't spoil anything, but you can find a copy of the short report in PDF format here (direct download): https://gitlab.torproject.org/tpo/ux/research/-/raw/master/reports/2021/pub… <https://gitlab.torproject.org/tpo/ux/research/-/raw/master/reports/2021/pub…> Thank you very much to everyone who participated, and let us know if you have any questions or comments about the results! — Duncan Larsen-Russell UX Designer duncan(a)torproject.org <mailto:duncan@torproject.org>

1 0