February 2012 - tor-relays - lists.torproject.org

pluggable transport proxy
by Scott Bennett 19 Feb '12

19 Feb '12

A recent posting--sorry, but I deleted it before realizing that I had something to say as a followup--referred to proposal #180 (see https://gitweb.torproject.org/torspec.git/blob/HEAD:/proposals/180-pluggabl… for the text), and after reading the section titled "Notes on plugins to write", it seemed to me that the first note might be satisfied by tcpproxy with little or no modification. The developers might wish to look at its description at http://www.spreadspace.org/tcpproxy/ It handles IPv4, IPv6, and cross-protocol tunneling, as well as optionally doing remote DNS resolution. FWIW, I like the mentions of possibly allowing the use of such proxies with ordinary relays, too. This might provide an opening to allow unpublished, extra ORPorts of ordinary relays to be distributed and used in a manner similar to bridges. Allowing pluggable proxies for ordinary relays ought also to facilitate development and testing of UDP- and SCTP-based transports for tor in a way that would avoid disrupting existing tor network operation. Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * **********************************************************************

1 0

30% drop in exit throughput since Feb 8
by Andy Isaacson 19 Feb '12

19 Feb '12

Noisetor is showing a significant, sustained drop in bandwidth usage starting approximately February 7-8. We've checked our setup and logs and there doesn't appear to be any sign of a causative factor here. Throughout January and the first week of February we were averaging 400-500 Mbps. There was a pretty smooth decline down on the 8th, stabilizing at a "new normal" of 200-300 Mbps which we've maintained since then. (All these numbers are based on Munin graphs of eth0 throughput using the if_ plugin.) I have some hacky Python that summarizes the torstatus.blutmagie.de data, and it appears that other exits didn't see a similar drop; but our drop came a few hours to days after torservers added a significant amount of new bandwidth. (However, total exit BW reported in torstatus did not increase much; if anything it seems to have gone down slightly.) Around the same time, Amunet rose from ~150 Mbps to ~450 Mbps and has remained in that range since. Thoughts? -andy

3 3

Can bridge run in tiny VPS
by tor-relays＠nickcoleman.org 14 Feb '12

14 Feb '12

After reading on Hacker News about Tor's request for bridges for Syria and Iran, I thought perhaps I could use my el-cheapo VPS for this. I use it to run an anonymous forwarding proxy for my own use. It gets very little use, so I can do without the proxy for a few months. Mem is limited to 128MB, with bursts to 256MB. Bandwidth is 500GB up and down per month. Tor can have half of this (note the up *and* down). The caveat is that, because it is a dirt cheap VPS, I don't get a warning about any violation of the TOS. If I go outside the guidelines, they cancel my account. So I need to be fairly certain, or somehow limit Tor, that its memory use in normal circumstances will not exceed ~100MB. Is it feasible to run a bridge within these limits? If so, any suggestions on config options welcome. thanks, Nick

5 4

HardwareAccel
by Sebastian Urbach 03 Feb '12

03 Feb '12

Hi, Does anyone know how to use the HardwareAccel feature correctly ? Somehow im not able to get this working on my Intel cpus wit the hardware AES engine built in. It would be great to get it up and running because 24 cores could do some nice work for tor ;-) Thanks in advance -- Mit freundlichen Grüßen / Yours sincerely Sebastian Urbach -------------------------------------------------------- Religion is something left over from the infancy of our intelligence, it will fade away as we adopt reason and science as our guidelines. -------------------------------------------------------- Bertrand Arthur William Russell (1872-1970), British philosopher, logician, mathematician, historian, and social critic.

2 1

reg : problem using the OPAddon script from the torflow package
by Sambuddho Chakravarty 02 Feb '12

02 Feb '12

Hi All I am trying to use the OPAddon script to measure circuit bandwidth. I use the following input configuration for pathrc input configuration: [GENERAL] # Set the host and port where Tor is # listening for control-connections control_host = 127.0.0.1 control_port = 9051 [CIRC_MANAGEMENT] # Size of the maintained pool of circuits idle_circuits = 3 # TODO: Configure ports to use [NODE_SELECTION] # Number of hops to be used in paths and # a minimum-value for advertised bandwidth pathlen = 3 min_bw = 1024 # Percentiles percent_fast = 100 percent_skip = 0 use_all_exits = yes # UniformGenerator with optionally ordered exits, # 'uniform = no' --> bandwidth-weighted selection uniform = no order_exits = no # Make use of guard-nodes (yes|no) or a specific # exit node (nickname or IDHex) for every path use_guards = yes #use_exit = xyz [GEOIP] # Use GeoIP use_geoip = no # yes|no for unique|equal country codes # ! comment out to don't care unique_countries = no # Maximum number of continent crossings: 0-n # ! comment out to enforce distinct continents # ! set >= pathlen to not care about #max_continent_crossings = 2 # Maximum number of ocean crossings: 0-n # ! comment out to don't care #max_ocean_crossings = 1 # If echelon is set, OP-Addon will try to find an # exit in the destination country of the current # request (exit_country may be used as backup) # yes|no # TODO: echelon = yes # Set country codes for single positions #entry_country = DE #middle_country = RU #exit_country = US # TODO: excludes = [".."] [RTT] # Frequently ping the latencies of complete circuits # yes|no ping_circs = no # Tor socks-properties socks_host = 127.0.0.1 socks_port = 9050 ping_dummy_host = 127.0.0.1 ping_dummy_port = 100 # Time interval to wait before triggering # pings and frequency of pings in seconds (float) initial_interval = 10 frequency = 5 # Close a circuit after n timeouts on measurings # Set to 0 to never close circs (int) timeout_limit = 1 [MODEL] # Set to 'yes' to measure latencies of single links # and enable circuit creation from the model # yes|no network_model = no # Min ratio of circs created with the backup-method, # controls growing of the model (float in [0,1]) # 0: no growing # 1: growing only min_ratio = 0.5 # RTT-threshhold in seconds when creating circs (float): # 0: no threshhold, choose from all proposals max_rtt = 0 # Minimum number of proposals to choose from (int) min_proposals = 100 [EVALUATE] # Evaluation mode: close every circuit after measuring performance # yes|no evaluate = yes # Number of latency-tests per circuit (int: 0-n) num_rtt_tests = 1 # Number of bandwidth-tests per circuit (int:0 or 1) # Requires stream-server.pl listening on the same host num_bw_tests = 1 # Total amount of circuits to test (int) num_records = 5 I run op-addon.py with the above config and it terminates throwing the following error pointing to PathSupport.py. WARN[Thu Feb 02 17:45:58 2012]:No event for: 650 STREAM 76 CLOSED 47 128.59.16.165:8041 REASON=DONE Traceback (most recent call last): File "<home directory>/torflow.saved/torflow-3c0dd74/TorCtl/TorCtl.py", line 712, in _eventLoop self._handleFn(timestamp, reply) File "<home directory>/torflow.saved/torflow-3c0dd74/TorCtl/TorCtl.py", line 1337, in _handle1 self._map1.get(event.event_name, self.unknown_event)(event) File "./op-addon.py", line 853, in stream_status_event return self.handle_bw_test(s) File "./op-addon.py", line 823, in handle_bw_test lifespan = stream.lifespan(stream.bw_timestamp) File "<home directory>/torflow.saved/torflow-3c0dd74/TorCtl/PathSupport.py", line 1326, in lifespan return now-self.attached_at TypeError: unsupported operand type(s) for -: 'NoneType' and 'float' NOTICE[Thu Feb 02 17:45:58 2012]:Tor closed control connection. Exiting event thread. Terminated I am not sure how to resolve this ... I am not sure if I am doing something wrong or not... Thanks Sambuddho

1 0

Tor relay system & uptime requirements
by Goulven Guillard 02 Feb '12

02 Feb '12

Hi all, I am considering setting up a tor relay. However my configuration is not powerful and I failed to find precise informations about the hardware system requirements. I believe it would be useful to have such informations in the FAQ, along with graphs of the needed RAM & CPU as a function of the allocated bandwidth. Anyway, I would use a Sheevaplug (Marvell 1.2 GHz CPU, 512 MB DDR2 @ 400 MHz) running Debian Squeeze. It already serves as a small webserver (~200 visits/month, <10 MB bandwidth/month), and 150 MB of RAM are allocated to flashybrid (which helps preserving the SD card life by keeping /var/log/* and such data in RAM and write it down only once in a while). First questions : would it be eligible as a tor relay ? As a tor exit ? Or should I rather go for a bridge ? I guess my bandwidth will be limited by the hardware, how much would you suggest ? On the same network is my personal computer which is much more powerful but down most of the day, so I guess it would be unworthy to make use of it ? I have also thought about using the PC of my parents as a bridge (smaller bandwidth), but again it is online only a few hours a day, would it be worth it ? Thanks. Regards, G.

7 10

0.2.3.10-alpha / .11-alpha
by Sebastian Urbach 02 Feb '12

02 Feb '12

Hi, I was wondering if one of you had a message in the log from 0.2.3.10-alpha which was that he coul not access the AES hardware engine and is using software instead. I upgraded to .11-alpha a day later and the message seems to be gone. Does anybody know how to check if he can access the AES hardware engine now or is the feature just disabled in the new version ? Normally he sould be able to access the feature because the Intel CPUs in the system support it, Thanks in advance -- Mit freundlichen Grüßen / Yours sincerely Sebastian Urbach -------------------------------------------------------- Religion is something left over from the infancy of our intelligence, it will fade away as we adopt reason and science as our guidelines. -------------------------------------------------------- Bertrand Arthur William Russell (1872-1970), British philosopher, logician, mathematician, historian, and social critic.

1 0

Re: [tor-relays] Thoughts on InspecTor?
by Scott Bennett 02 Feb '12

02 Feb '12

On Thu, 2 Feb 2012 00:25:19 -0500 Roger Dingledine <arma(a)mit.edu> wrote: >On Wed, Feb 01, 2012 at 11:36:57PM -0500, Steve Snyder wrote: >> This application claims to identify bad Tor nodes for the purpose of >> excluding them from use: >> >> http://xqz3u5drneuzhaeo.onion/users/badtornodes/ >> >> Anyone have any thoughts on this? > >In general it is a poor plan to change your routing strategy in a way >that makes you different from most Tor users. If you change it enough, >you end up making a signature for your behavior where an attacker can >say "hey, that's the guy who never uses German relays". The result is >that you harm your anonymity. Nobody has really researched how much harm >comes from how much difference -- and we recommend against doing things >that are poorly understood. > >> The sum of bad-exit-flags (8), > >As far as I can tell, >http://xqz3u5drneuzhaeo.onion/users/badtornodes/overview.html#blocking >are all tiny relays so it doesn't much matter whether you badexit them >(you're probably never going to encounter them in practice anyway). > >For the question of exit relays in Iran, see >https://trac.torproject.org/projects/tor/ticket/4207 >https://trac.torproject.org/projects/tor/ticket/4923 > The latter ticket's discussion section is quite interesting. After reading through it, it seems to me that the problem in Roger's point C would be best dealt with in vidalia without regard to IP address or presumed country. When asking whether the user wishes to run a relay, vidalia's dialog could include an instruction something like this: "Before you decide to run a tor relay, please consider whether the government of the country where you live and/or would like to operate a relay might target you for any kind of abuse if that government noticed that you were running a tor relay." As long as the people who have volunteered to provide translations for vidalia's and/or tor's textual interactions with users have sufficient skills to provide such a cautionary note in all of the most necessary languages plus two or three languages spoken widely around the world, then that should take care of the matter. I share the concerns of both Roger and Sebastian regarding undesirable potential results of automating the rejection of entire countries of relays. Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * **********************************************************************

1 0

Thoughts on InspecTor?
by Steve Snyder 02 Feb '12

02 Feb '12

This application claims to identify bad Tor nodes for the purpose of excluding them from use: http://xqz3u5drneuzhaeo.onion/users/badtornodes/ Anyone have any thoughts on this? The sum of bad-exit-flags (8), exit nodes that alter payload (4), and long-term-misconfigured (27) suggests excluding 39 nodes within the Tor config file. Is this reasonable? Are these exclusions appropriate for relays, or for end users, or neither, or both?

2 1