December 2020 - tor-commits - lists.torproject.org

[tor/master] relay: Log address suggested by directory authorities
by dgoulet＠torproject.org 21 Dec '20

21 Dec '20

commit aae9a05a018b0baed785cb030c941adc4d2c2d12 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Dec 21 14:41:52 2020 -0500 relay: Log address suggested by directory authorities If we get an address suggestion from a directory authority and we have no address configured or discovered, log it at notice level so the operator can learn what address will be used by Tor. Fixes #40201 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket40201 | 3 +++ src/app/config/resolve_addr.c | 12 ++++++++++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/changes/ticket40201 b/changes/ticket40201 new file mode 100644 index 0000000000..cdf8d99172 --- /dev/null +++ b/changes/ticket40201 @@ -0,0 +1,3 @@ + o Minor bugfixes (logging, relay): + - Logs the address discovered by the directory authorities if none were + configured or detected before. Fixes bug 40201; bugfix on 0.4.5.1-alpha. diff --git a/src/app/config/resolve_addr.c b/src/app/config/resolve_addr.c index b811a68b8c..080cb967bc 100644 --- a/src/app/config/resolve_addr.c +++ b/src/app/config/resolve_addr.c @@ -130,8 +130,16 @@ resolved_addr_set_suggested(const tor_addr_t *addr) tor_addr_family(addr) != AF_INET6)) { return; } - tor_addr_copy(&last_suggested_addrs[af_to_idx(tor_addr_family(addr))], - addr); + + /* In case we don't have a configured address, log that we will be using the + * one discovered from the dirauth. */ + const int idx = af_to_idx(tor_addr_family(addr)); + if (tor_addr_is_null(&last_resolved_addrs[idx]) && + !tor_addr_eq(&last_suggested_addrs[idx], addr)) { + log_notice(LD_CONFIG, "External address seen and suggested by a " + "directory authority: %s", fmt_addr(addr)); + } + tor_addr_copy(&last_suggested_addrs[idx], addr); } /** Copy the last resolved address of family into addr_out.

1 0

[tor/release-0.4.5] relay: Log address suggested by directory authorities
by dgoulet＠torproject.org 21 Dec '20

21 Dec '20

commit aae9a05a018b0baed785cb030c941adc4d2c2d12 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Dec 21 14:41:52 2020 -0500 relay: Log address suggested by directory authorities If we get an address suggestion from a directory authority and we have no address configured or discovered, log it at notice level so the operator can learn what address will be used by Tor. Fixes #40201 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket40201 | 3 +++ src/app/config/resolve_addr.c | 12 ++++++++++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/changes/ticket40201 b/changes/ticket40201 new file mode 100644 index 0000000000..cdf8d99172 --- /dev/null +++ b/changes/ticket40201 @@ -0,0 +1,3 @@ + o Minor bugfixes (logging, relay): + - Logs the address discovered by the directory authorities if none were + configured or detected before. Fixes bug 40201; bugfix on 0.4.5.1-alpha. diff --git a/src/app/config/resolve_addr.c b/src/app/config/resolve_addr.c index b811a68b8c..080cb967bc 100644 --- a/src/app/config/resolve_addr.c +++ b/src/app/config/resolve_addr.c @@ -130,8 +130,16 @@ resolved_addr_set_suggested(const tor_addr_t *addr) tor_addr_family(addr) != AF_INET6)) { return; } - tor_addr_copy(&last_suggested_addrs[af_to_idx(tor_addr_family(addr))], - addr); + + /* In case we don't have a configured address, log that we will be using the + * one discovered from the dirauth. */ + const int idx = af_to_idx(tor_addr_family(addr)); + if (tor_addr_is_null(&last_resolved_addrs[idx]) && + !tor_addr_eq(&last_suggested_addrs[idx], addr)) { + log_notice(LD_CONFIG, "External address seen and suggested by a " + "directory authority: %s", fmt_addr(addr)); + } + tor_addr_copy(&last_suggested_addrs[idx], addr); } /** Copy the last resolved address of family into addr_out.

1 0

[tor/master] Merge branch 'maint-0.4.5'
by dgoulet＠torproject.org 21 Dec '20

21 Dec '20

commit e7da6810346c0e141d67e67db8ff4a1bdaedf67f Merge: 43b3880578 aae9a05a01 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Dec 21 14:55:44 2020 -0500 Merge branch 'maint-0.4.5' changes/ticket40201 | 3 +++ src/app/config/resolve_addr.c | 12 ++++++++++-- 2 files changed, 13 insertions(+), 2 deletions(-)

1 0

[tor/release-0.4.5] Merge branch 'maint-0.4.5' into release-0.4.5
by dgoulet＠torproject.org 21 Dec '20

21 Dec '20

commit f44c12a708de1bceb4dfac9490a67c8f41baee6e Merge: 7bbec935c5 aae9a05a01 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Dec 21 14:55:44 2020 -0500 Merge branch 'maint-0.4.5' into release-0.4.5 changes/ticket40201 | 3 +++ src/app/config/resolve_addr.c | 12 ++++++++++-- 2 files changed, 13 insertions(+), 2 deletions(-)

1 0

[community/master] Add terraform-onions and heroku. Fix #151
by gus＠torproject.org 21 Dec '20

21 Dec '20

commit c9bc488589746935764b2d6b0a457a62032e9514 Author: gus <gus(a)torproject.org> Date: Mon Dec 21 14:39:13 2020 -0500 Add terraform-onions and heroku. Fix #151 --- content/onion-services/setup/contents.lr | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/onion-services/setup/contents.lr b/content/onion-services/setup/contents.lr index b872eaf..a95fe51 100644 --- a/content/onion-services/setup/contents.lr +++ b/content/onion-services/setup/contents.lr @@ -163,5 +163,5 @@ That is not an easy task, and these resources will help on how to make this poss Finally, if you plan to keep your service available for a long time, you might want to make a backup copy of the `private_key` file somewhere. -Now that you have an onion site working, you may want to deploy [Onion-Location](https://community.torproject.org/onion-services/advanced/on…, or use tools like Docker, [Ansible](https://galaxy.ansible.com/systemli/onion) or [stem](https://stem.torproject.org/tutorials/over_the_river.html) to automate the management of your onion services. +Now that you have an onion site working, you may want to deploy [Onion-Location](https://community.torproject.org/onion-services/advanced/on…, or use tools like Docker, [Heroku](https://gitlab.torproject.org/hiro/onions-on-heroku), [Terraform](https://gitlab.torproject.org/hiro/terraform-onions), [Ansible](https://galaxy.ansible.com/systemli/onion) or [stem](https://stem.torproject.org/tutorials/over_the_river.html) to automate the management of your onion services. If you have a static website, but never installed Nginx or Apache, another project to try is [OnionShare](https://onionshare.org), where running an onion site will be easier: guided with a graphic interface and with minimal configuration.

1 0

[community/master] Add guideline document.
by gus＠torproject.org 21 Dec '20

21 Dec '20

commit 2d35ea1dc8e6db282e0e5232320fdd57547ac92e Author: gus <gus(a)torproject.org> Date: Mon Dec 21 09:55:39 2020 -0500 Add guideline document. --- content/onion-services/advanced/dos/contents.lr | 65 +++++++++++++++++++++++++ 1 file changed, 65 insertions(+) diff --git a/content/onion-services/advanced/dos/contents.lr b/content/onion-services/advanced/dos/contents.lr new file mode 100644 index 0000000..297e88b --- /dev/null +++ b/content/onion-services/advanced/dos/contents.lr @@ -0,0 +1,65 @@ +section: advanced configuration +--- +section_id: onion-services +--- +color: primary +--- +_template: layout.html +--- +title: Onion service DoS guidelines +--- +subtitle: Tips to help you keep afloat in turbulent times. +--- +key: 5 +--- +html: two-columns-page.html +--- +body: + +In this page we present a few ways to mitigate DoS attacks currently. +However there is no single one-size-fits-all solution for this problem at the moment. +Defending a site under attack requires creativity and a custom-tailored approach. +Here are a few tips: + +### Onionbalance + +[Onionbalance](https://onionbalance-v3.readthedocs.io/en/latest/v3/tutorial-v3.html) allows onion service operators to achieve the property of high availability by allowing multiple machines to handle requests for an onion service. +You can use Onionbalance to scale horizontally. +The more you scale, the harder it is for attackers to overwhelm you. +Onionbalance is available for [v3 onion services](https://blog.torproject.org/cooking-onions-reclaiming-onionbalanc…. + +### Client authorization or multiple onion addresses to compartmentalize your users + +If you have users you trust, give them dedicated onion service and client authorization credentials so that it can always be available. +For users you don't trust, split them into multiple addresses. +That said, having too many onion addresses is actually bad for your security (because of the use of many guard nodes), so try to use [client authorization](https://community.torproject.org/onion-services/advanced/cli… when possible. + +### Captchas and cookies + +If you need to further rate-limit users, split your infrastructure into layers and put Captchas near the frontend. +This way attackers will have to solve Captchas before they are able to attack deeper into your infrastructure. + +Captchas are a way to mitigate DDoS attacks. +When a request comes from a client checks if the client contains the correct secure cookie otherwise redirects to the recaptcha page. +The client inputs the captcha letters. +Nginx sends this input letters to recaptcha server for verification. + +The correct answer from recaptcha server with beginning of "true...", else it's beginning with "false...". +Add the secure cookie for the correct verified client, redirect the client to the page which he wants to view. + +It is possible to implement Captchas directly at your webserver with Nginx and OpenResty using [Lua to generate and verify the captcha images](https://github.com/openresty/lua-nginx-module). +This implementation isn't easy to configure. + +An alternative might be to just implement a test-cookie challenge. +At your webserver check that clients can set valid cookies, malicious clients often do not have this feature. +In Nginx, Cloudflare provide a [library](https://github.com/cloudflare/lua-resty-cookie) to interact with cookies. + +Other methods include making sure that clients connecting to your .onion have valid User-Agent header and the Referer header is not set to a value you can associate with the attack. + +### Webserver rate limiting + +If attackers are overwhelming you with aggressive circuits that perform too many queries, try to detect that overuse and kill them using the `HiddenServiceExportCircuitID` torrc option. +You can use your own heuristics or use your web server's [rate limiting module](https://www.nginx.com/blog/rate-limiting-nginx/). + +The above tips should help you keep afloat in turbulent times. +At the same time [we are working on more advanced defenses](https://blog.torproject.org/stop-the-onion-denial), so that less manual configuration and tinkering is needed by onion operators.

1 0

[community/master] Merge branch 'onion-guide-dos'
by gus＠torproject.org 21 Dec '20

21 Dec '20

commit 6afc1945816178a49857b9386896a0dfa347e746 Merge: 08c7257 2d35ea1 Author: gus <gus(a)torproject.org> Date: Mon Dec 21 14:33:41 2020 -0500 Merge branch 'onion-guide-dos' content/onion-services/advanced/dos/contents.lr | 65 +++++++++++++++++++++++++ 1 file changed, 65 insertions(+)

1 0

[translation/tails-misc_release] https://gitweb.torproject.org/translation.git/commit/?h=tails-misc_release
by translation＠torproject.org 21 Dec '20

21 Dec '20

commit 45dd68ebbe7182baa01e510970f864130bba3405 Author: Translation commit bot <translation(a)torproject.org> Date: Mon Dec 21 18:46:41 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tails-misc_release --- sv.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sv.po b/sv.po index fb46a931bd..f9fdf7c2e0 100644 --- a/sv.po +++ b/sv.po @@ -25,8 +25,8 @@ msgstr "" "Project-Id-Version: Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2020-12-04 11:24+0100\n" -"PO-Revision-Date: 2020-12-11 09:16+0000\n" -"Last-Translator: Transifex Bot <>\n" +"PO-Revision-Date: 2020-12-21 18:23+0000\n" +"Last-Translator: Jonatan Nyberg <jonatan.nyberg.karl(a)gmail.com>\n" "Language-Team: Swedish (http://www.transifex.com/otf/torproject/language/sv/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n"

1 0

[translation/tails-misc] https://gitweb.torproject.org/translation.git/commit/?h=tails-misc
by translation＠torproject.org 21 Dec '20

21 Dec '20

commit 81124f3f16c1bec1294a3b9300067018305d0a2f Author: Translation commit bot <translation(a)torproject.org> Date: Mon Dec 21 18:45:54 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tails-misc --- sv.po | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/sv.po b/sv.po index 40f95b7b3d..dbf87b8bcc 100644 --- a/sv.po +++ b/sv.po @@ -25,8 +25,8 @@ msgstr "" "Project-Id-Version: Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2020-12-04 11:24+0100\n" -"PO-Revision-Date: 2020-12-11 09:16+0000\n" -"Last-Translator: Transifex Bot <>\n" +"PO-Revision-Date: 2020-12-21 18:23+0000\n" +"Last-Translator: Jonatan Nyberg <jonatan.nyberg.karl(a)gmail.com>\n" "Language-Team: Swedish (http://www.transifex.com/otf/torproject/language/sv/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -241,7 +241,7 @@ msgid "" "It is not possible to automatically upgrade your device to this new version: {explanation}.\n" "\n" "To learn how to do a manual upgrade, go to {manual_upgrade_url}" -msgstr "" +msgstr "<b>Du bör göra en manuell uppgradering till {name} {version}.</b>\n\nMer information om den här nya versionen finns på {details_url}\n\nDet är inte möjligt att automatiskt uppgradera din enhet till den här nya versionen: {explanation}.\n\nFör att lära dig hur man gör en manuell uppgradering, gå till {manual_upgrade_url}" #: config/chroot_local-includes/usr/src/iuk/lib/Tails/IUK/Frontend.pm:471 msgid "New version available" @@ -1588,7 +1588,7 @@ msgid "" "\n" "Or do a manual upgrade.\n" "See {manual_upgrade_url}" -msgstr "" +msgstr "<b>Det finns inte tillräckligt med minne för att söka efter uppgraderingar.</b>\n\nSe till att detta system uppfyller kraven för att köra Tails.\nSe file:///usr/share/doc/tails/website/doc/about/requirements.en.html\n\nFörsök att starta om Tails för att söka efter uppgraderingar igen.\n\nEller gör en manuell uppgradering.\nSe {manual_upgrade_url}" #: config/chroot_local-includes/usr/local/bin/tails-upgrade-frontend-wrapper:76 #: config/chroot_local-includes/usr/local/sbin/unsafe-browser:27

1 0

[tor/master] Merge branch 'mr_240_squashed' into maint-0.4.5
by nickm＠torproject.org 21 Dec '20

21 Dec '20

commit ad00da663ea008cf47a7a70df21f855bfddad142 Merge: d45354d5ea f4cbcde2da Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Dec 21 13:25:52 2020 -0500 Merge branch 'mr_240_squashed' into maint-0.4.5 changes/ticket40226 | 5 +++ src/feature/relay/router.c | 106 +++++++++++++++++++++++++++------------------ src/feature/relay/router.h | 2 + src/test/test_stats.c | 81 ++++++++++++++++++++++++++++++++++ 4 files changed, 151 insertions(+), 43 deletions(-)

1 0