- tor-dev - lists.torproject.org

Please consider allowing /48 for VirtualAddrNetworkIPv6
by Alex Elsayed 17 Sep '16

17 Sep '16

Hi, I'm using Tor in transparent mode, and I'm running into a rather inconvenient behavior. VirtualAddrNetworkIPv6 refuses to parse unless the network address given is a /40 or broader. However, IPv6 ULA, which makes it very easy to give Tor its own subnet no-strings-attached, strictly grants a /48 prefix. As a result, I am faced with a choice between deeply suboptimal options: 1.) Use VirtualAddrNetworkIPv4, as I've done in the past. This results in _fewer_ addresses being available to Tor than an IPv6 /48, which I feel illustrates the issues with requiring a /40 quite clearly. 2.) Squat on some portion of the IPv6 address space I don't actually own. This is entirely unpalatable

3 5

OnionView : A GUI to view circuits & streams
by Kevin Steen 16 Sep '16

16 Sep '16

I wanted a way to watch the streams being created while using TorBrowser, so I've created a Python Tk GUI to show the circuits and their associated streams: https://github.com/skyguy/onionview Each circuit is shown with the relays' country codes and nicknames. Streams are listed below the circuit they're attached to, showing the domain name and resolved IP. The view scrolls automatically when a circuit or stream is first shown. It's quite simple, without any bells and whistles yet, but quite useful to see what's going on while waiting for a webpage to display, so I thought I'd put it out there in case someone else finds it useful. OnionView uses the excellent Stem library, so make sure you have that installed. It works with Python 2 and 3. All feedback and advice welcome! -Kevin

3 3

Reg:https-everywhere
by AKASH DAS 15 Sep '16

15 Sep '16

Respected all, Can I ask my doubts regarding https-everywhere and any bugs issue in this mailing list as I already posted one bug but I didn't get any reply regarding that error. So any help would be very helpful to me. -- *Akash Das* *Student Systems Admin* *Indian Institute Of Information Technology* *Sricity*

2 1

"old style" hidden services after Prop224
by Razvan Dragomirescu 14 Sep '16

14 Sep '16

Hello everyone, I've pretty much completed a proof of concept of my SIM4Things project (an IP6 overlay for the Internet of Things running on top of Tor with persistent secure cryptographic identities tied to physical SIM cards). I've developed against the current hidden service infrastructure and it appears to work like a charm, but I'm a bit worried about Prop224. That will break both the OnionBalance-like service re-registration that I'm using _and_ the OnionCat HS to IP6 mapping. I know that efforts are in place to upgrade the two in view of Prop224 but I'm wondering if there's any good reason to drop support for "old style" hidden services once Prop224 is fully deployed. What does everyone think? My vote would obviously be to keep it around, even if it's no longer the default. Do you see any security implications in doing so? Is there any hard reason to drop the existing model altogether at some point and if so, what is the plan for transition? My hidden services would be very low traffic (Internet of Things, sensor measurements, etc) but hard to upgrade in the field. Also, by design, we have no control over the endpoints once deployed (only their owner can access them), so we cannot force an upgrade, we can just suggest it to the owner and come up with a procedure for them to do so. Any ideas? Thank you, Razvan -- Razvan Dragomirescu Chief Technology Officer Cayenne Graphics SRL

6 15

Tor path selection upon failure
by Liu, Zhuotao 14 Sep '16

14 Sep '16

Hi Folks, There have been some technical reports about how to deal with the problem when a botnet uses Tor as its primary C&C channel. In this case, the CPU of some relays is exhausted, causing circuit creation failure. I am wondering currently how a client reacts when its circuit creation fails? Does the client simply resends create cells to the relays on the original path or it will re-select a new path instead? Thanks

2 2

[Patch] common/util_bug.h
by Gisle Vanem 14 Sep '16

14 Sep '16

The 'IF_BUG_ONCE__' for non-gcc is wrong. A simple patch: --- a/util_bug.h 2016-09-13 10:44:59 +++ b/util_bug.h 2016-09-08 20:24:45 @@ -117,7 +117,7 @@ #else #define IF_BUG_ONCE__(cond,var) \ static int var = 0; \ - if (PREDICT_UNLIKELY(cond)) ? \ + if (PREDICT_UNLIKELY(cond) ? \ (var ? 1 : \ (var=1, \ tor_bug_occurred_(SHORT_FILE__, __LINE__, __func__, \ -- --gv

2 1

Tor path selection upon failure
by Liu, Zhuotao 13 Sep '16

13 Sep '16

Hi Folks, There have been some technical reports about how to deal with the problem when a botnet uses Tor as its primary C&C channel. In this case, the CPU of some relays is exhausted, causing circuit creation failure. I am wondering currently how a client reacts when its circuit creation fails? Does the client simply resend another create cell or it will re-select new path instead? Thanks

2 1

How to query HS hostname from control port
by Jesse V 10 Sep '16

10 Sep '16

Hi everyone, TL;DR: Please let me know how to fetch the hostname of my hidden service from Tor's control port. Say I have configured torrc to set up a hidden/onion service. By default, it's set up in /var/lib/tor/hidden_service, a directory which isn't world-readable. My software can authenticate into Tor's control port, but it needs to know the hostname/address of the service. It can't read the hidden_service/hostname file directly, and so far I haven't figured out how to query Tor for that information. As a last resort, I suppose I could copy /var/lib/tor/hidden_service/hostname to a directory that the software can read, but I'd like to avoid that if possible. I have hunted through https://gitweb.torproject.org/torspec.git/tree/control-spec.txt without too much success. The closest I have come is "GETCONF HiddenServiceOptions" but I suspect that the option is under GETINFO instead. However, the documentation mostly describes how to query information about other onion services. I need to know about my service though, if that's possible. Please advise. -- Jesse V I look forward to seeing everyone again in July at Minneapolis. :)

5 14

Hmac
by Flipchan 10 Sep '16

10 Sep '16

Hi all, so i spook with a friend of mine yesterday and we where chating about encryption and i told him that i use scrypt for password hashing. He told that hmac was alot better. Does anyone know any Good whitepapers on hmac? Any Good python lib? Does anyone use it ? Take care -- Sincerly Flipchan

3 2

Dirauth setting for PathsNeededToBuildCircuits
by Jesse V 09 Sep '16

09 Sep '16

Tor clients can only build circuits once they know enough about the network. This "know enough" threshold is determined by the PathsNeededToBuildCircuits setting. From reading Tor's manual, it seems that a setting of X tells Tor clients to wait until they have enough descriptors/microdescriptors such that they have X percentage of consensus weight. By default PathsNeededToBuildCircuits is determined by the directory authorities. I'm curious, how is PathsNeededToBuildCircuits set? I don't see that value in the microdescriptor documents, it doesn't seem to be documented in tor-spec, and I don't see much about it online, but maybe I missed something. What is the typical value? I see that 0.95 is the cutoff, but how high will prevent a client from bootstrapping? -- Jesse V

2 1