April 2013 - tor-relays - lists.torproject.org

Circuit creation "storms" overwhelming Raspberry Pi?
by torsion＠ftml.net 08 Jul '13

08 Jul '13

Hi there, I just joined the mailing list and apologized if this has been discussed before. I did find discussion of a similar issue in January 2013's archive: https://lists.torproject.org/pipermail/tor-relays/2013-January/001809.html It's important to note that I believe I've seen (but didn't save logs) a couple "circuit creation burst" events on my established relay (about 5Mbps, stable, guard, non-exit) which was mostly able to handle it without crashing as it has plenty of RAM and the above-mentioned messages - "Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a m ore restricted exit policy." - appear only with the relay is under load for other reasons AND a large number of circuits are being suddenly created. I wondered if this was some kind of DOS attempt but didn't think much of it because my fast relay continued working fine. However, I've just set up a Raspberry Pi, the 512MB model, as a relay on a slower connection. Here are the relevant settings on this relay: RelayBandwidthRate 130 KB RelayBandwidthBurst 340 KB The Pi has a fairly slow CPU, so I'd occasionally get messages about log deduplication being too slow or something, but didn't think much of it. I finally got the relay up and left it up for over 24 hours. When I woke up this morning it had crashed. Here are the relevant log messages - note the huge jump in number of circuits between 22:35 and 04:35 (maybe I got the Stable flag), then the storm of circuit open requests starting at 05:49. Eventually I believe the Pi ran out of memory and killed the tor process. What's very interesting here is that my fast VPS relay with a RelayBandwidthRate over 5x faster is almost never handling much more than 1000 circuits, so why all of a sudden the demand on the Pi that's advertising a lower bandwidth rate? Mar 17 22:35:00.000 [notice] Heartbeat: Tor's uptime is 1 day 0:00 hours, with 26 circuits open. I've sent 974.13 MB and received 969.92 MB. Mar 18 04:35:00.000 [notice] Heartbeat: Tor's uptime is 1 day 6:00 hours, with 972 circuits open. I've sent 1.61 GB and received 1.59 GB. Mar 18 05:49:44.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. Mar 18 05:49:44.000 [warn] Failed to hand off onionskin. Closing. Mar 18 05:50:44.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [5817 similar message(s) suppressed in last 60 seconds] Mar 18 05:52:30.000 [warn] Your system clock just jumped 101 seconds forward; assuming established circuits no longer work. Mar 18 05:53:51.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [1055 similar message(s) suppressed in last 60 seconds] Mar 18 05:55:14.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [329 similar message(s) suppressed in last 60 seconds] I'd like to figure out just how much the Raspberry Pi is capable of, because it could be a cheap way to build out the relay network by people who want to donate bandwidth - but of course it needs to be stable, and something about my setup is not. Also: Mar 16 20:55:33.000 [notice] No AES engine found; using AES_* functions. I have no idea if the Broadcom BCM2835 SoC (ARM1176JZF-S CPU) in the Pi has any AES capability, but it'd be great to find out.

3 4

A call to arms for obfuscated bridges
by George Kadianakis 06 May '13

06 May '13

Greetings, A year ago we asked you to run obfuscated bridges to help people in Iran [0]. Many people answered our call and we ended up having a big pool of obfuscated bridges to give to our users. Unfortunately, today, most of those bridges are down, and fresh ones are needed more than ever, since obfuscated bridges are the only way for people to access Tor in some areas of the world (like China, Iran and Syria). On the bright side, Tor's anti-censorship infrastructure has improved, and now you don't have to send the bridge addresses to us; if you run an obfuscated bridge with Tor 0.2.4.x, Tor will send its own address to BridgeDB [1] like normal bridges do. Also, obfsproxy was rewritten in Python and it now supports a new pluggable transport called 'obfs3' which works even in China [2]. We have dropped support for the C-version of Obfsproxy, and the new Pluggable Transport Bundles contain the Python version [3]. Finally, future pluggable transports will be developed for the Python version. Looking into BridgeDB, we have 200 obfs2 bridges, but only 40 obfs3 bridges: this means that we need more people running the new Python obfsproxy! Upgrading obfsproxy should be easy now, since we prepared new instructions and Debian/Ubuntu packages. If you run Debian or Ubuntu check out these instructiosn: https://www.torproject.org/projects/obfsproxy-debian-instructions.html.en otherwise use these: https://www.torproject.org/projects/obfsproxy-instructions.html.en (and make sure your pip is upgraded so that it uses HTTPS [4]) Furthermore, Tor's support assistants need some _unpublished_ bridges to give to censored users who ask for help via email. To configure an unpublished bridge you add "PublishServerDescriptor 0" to its torrc. After you do so, fire up Tor, and check its logs to find the ports that 'obfs2' and 'obfs3' are using. Send your IP and ports to tor-assistants(a)torproject.org. Finally, if in the future we need you to do something extra (for example to upgrade obfsproxy to support a new pluggable transport) we will send another mail to tor-relays. Thanks for the help! [0]: https://lists.torproject.org/pipermail/tor-talk/2012-February/023070.html [1]: https://bridges.torproject.org [2]: In China obfs2 is blocked using active probes: https://trac.torproject.org/projects/tor/ticket/8591 [3]: https://blog.torproject.org/blog/new-name-obfsproxy-tor-browser-bundles [4]: https://groups.google.com/forum/#!msg/python-virtualenv/foXxh-NpdGg/uT0NPc9…

14 26

Any operators in Singapore?
by Sanjeev Gupta 25 Apr '13

25 Apr '13

Hi, I run a number of Tor Relays, including exit nodes, in Singapore. I have recieved a request from the Singapore Police, who are investigating a case of "unauthorised payments via Paypal". They have asked for the customer to whom I have assigned the IP address (the request is because I am the whois contact for the network). Is there any other Singapore operator on the list who has experience? -- Sanjeev Gupta +65 98551208 http://www.linkedin.com/in/ghane

2 2

Using the name of a named node
by Konstantinos Asimakis 25 Apr '13

25 Apr '13

https://atlas.torproject.org/#details/A84D7DF9D58E0FAFF8CCC06A6A49DD96BD1DF… https://atlas.torproject.org/#details/12404BB1BB4F09CA65B76D77F347BC0D79CB7… How is this possible? I though that if you try to take the name of an unnamed node, your node switched to Unnamed or something like that automatically. Does the named flag prohibit other nodes from taking that name, or is it merely enabling clients to refer to you by name unambiguously? ----- My blog: http://www.inshame.com My full signature with lots of links etc: http://bit.ly/trtsig

2 1

Restart relay daily
by peckman＠hushmail.com 23 Apr '13

23 Apr '13

Hi! I am running a middle-man relay on a Raspberry Pi averaging 700 kBps. The board is very limited in processing power and memory. After some days, maybe a week, the Tor daemon runs out of memory and I have to start it manually again. I have tried different Tor versions, built alphas with and without the --enable-openbsd-malloc but it's no measurable difference; eventually a bad malloc will terminate the program. To solve this I have added a cron job to restart the daemon on a daily basis. Is this an OK solution? Traffic-wise it takes around 30 minutes to get back to normal throughput but the alternative is long downtimes until I notice the crash. Will there be any problem with the directory interaction? Relay info: Fast Guard Named Running Stable V2Dir Valid Tor 0.2.4.11-alpha Kind Regards, peckman

2 1

Re: [tor-relays] [tor-talk] NPA to urge Internet providers to block users of hijacking software [Tor]
by grarpamp 22 Apr '13

22 Apr '13

>> http://mainichi.jp/english/english/newsselect/news/20130418p2a00m0na013000c… "to voluntarily block communications if an anonymous software system ... is found abused online." The second ripline leaves some room but is without specifics. > It seems they are blurring the line between recommending that websites > refuse to answer connections from the Tor network, vs recommending that > ISPs prevent their users from reaching the Tor network. "The panel specifically recommends that communications be blocked when there is access from IP addresses publicly listed as those allocated to the third in a chain of computers that are used by Tor." This quote clears that up to be the former. However, it appears they also intend to ask network operators to block exits as well, not just websites: http://mainichi.jp/select/news/20130418k0000e040232000c.html "Based on the recommendations, the National Police Agency to encourage voluntary efforts such as the industry of Internet connection operators." They don't seem to say whether non-exits (thus the EG's among them) would remain accessible or not. "The Tor system was utilized by citizens in pro-democracy movements in the Middle East to escape government suppression, while Wikileaks also recommends Tor to information providers. The planned access restrictions are therefore expected to spark a backlash from the industry. 'Communication privacy is our lifeline. We won't be able to accept such a request,' said an industry insider. An NPA official said, 'We will make detailed explanations and seek their understanding.'" http://mainichi.jp/select/news/20130124k0000e040166000c.html "police were summarized for the strengthening of cyber crime investigation the 'emergency program' ... According to the National Police Agency, the police has been promoting public-private partnerships with such Internet-related companies so far, but pointed out that investigation and not keep up with the rapid advances in information and communication technology ... In the future, expanding the range to exchange personal level regardless of the occupation of the other party, and that improve the information collection... Emergency program, mentioned considerations and be entrusted to the private sector, the analysis of the modus operandi of education and other investigators" It's a little unclear to what degree these groups are for enforcement or education, whether they attend public conferences, etc. Likely the usual mix. There could be some good opportunities there. Cracking, corp/finance, data theft, copyright that sort of deal is one thing. But these idiots making death/bomb threats and such are really getting old not just on its face but due to their tendency to make the news and piss people off, and against Tor, in a different sort of way. I presume exit operators in Japan could ask NPA/Mainichi for the full panel doc and would be very interested in following this issue ... cc'd.

1 0

What is "regular" traffic on an obfuscated bridge
by Torry Torah 19 Apr '13

19 Apr '13

Hi there, After seeing the call to arm [1], I decided to spin up some 2 new obfuscated bridges. I am already running 2 (non-obf) bridges, and was about to boot 3 others. I'm seeing something like 4MB/day of traffic with those obf bridges, whereas the 2 non-obf bridges show something like 10MB/sec. ( All the servers more or less have the same specs, so it's not a hardware/connectivity issue. My question is: is it a "normal" amount of traffic on an obf bridge? For what it's worth, I followed intructions here [2] on an ubuntu precise with a firewall. I allowed communications on the OR port and the 2 ports given by obf2 and obf3. I've set up the 2 obf bridges 8 hours ago, give or take, maybe is it just a matter of insufficient uptime? Cheers, [1] https://lists.torproject.org/pipermail/tor-relays/2013-April/002089.html [2] https://www.torproject.org/projects/obfsproxy-debian-instructions.html.en

4 5

Trying to set up an obfs2/3 bridge on Windows, missing something.
by Asa Rossoff 18 Apr '13

18 Apr '13

I think I'm suppling the ServerTransport parameters incorrectly. the log seems to indicate it is listening on the wrong ports for obfs2 and obfs3. Since it was the only compiled package I saw for Windows with obfs support, I downloaded the tor-pluggable-transports-browser-2.4.11-alpha-2. I am using the following .torrc -- Address *obfuscated* AvoidDiskWrites 1 BridgeRelay 1 LearnCircuitBuildTimeout 0 CircuitBuildTimeout 60 ClientTransportPlugin websocket exec flashproxy-client --register :0 :56833 *[not useful, I realize]* ContactInfo *obfuscated* ControlPort 9051 CookieAuthentication 1 DataDirectory *obfuscated* DirPort 0 DirReqStatistics 0 ExitPolicy reject *:* GeoIPFile *obfuscated*/geoip GeoIPv6File *obfuscated*/geoip6 HardwareAccel 1 ServerTransportPlugin obfs2,obfs3 exec pyobfsproxy managed ServerTransportListenAddr obfs2,obfs3 0.0.0.0:56831 0.0.0.0:56832 Log notice stdout Nickname *obfuscated* NumCPUs 4 ORPort 56830 RelayBandwidthBurst 97280 RelayBandwidthRate 71680 SocksListenAddress 127.0.0.1 SocksPort 9050 I get the following log messages on starting Tor: [Notice] Tor v0.2.4.11-alpha (git-fcd9248387249d68) running on Windows 7 with Libevent 2.0.21-stable and OpenSSL 1.0.0k. [Notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning [Notice] This version is not a stable Tor release. Expect more bugs than usual. [Notice] Read configuration file "*obfuscated*\torrc". [Notice] Opening Socks listener on 127.0.0.1:9050 [Notice] Opening Control listener on 127.0.0.1:9051 [Notice] Opening OR listener on 0.0.0.0:56830 [Notice] Parsing GEOIP IPv4 file *obfuscated*/geoip. [Notice] Parsing GEOIP IPv6 file *obfuscated*/geoip6. [Notice] Your Tor server's identity key fingerprint is '*obfuscated* *obfuscated*' [Notice] We now have enough directory information to build circuits. [Notice] Bootstrapped 80%: Connecting to the Tor network. [Notice] New control connection opened. [Notice] Bootstrapped 85%: Finishing handshake with first hop. [Notice] Registered server transport 'obfs3' at '0.0.0.0:60093' [Notice] Registered server transport 'obfs2' at '0.0.0.0:60094' [Notice] Bootstrapped 90%: Establishing a Tor circuit. [Notice] Tor has successfully opened a circuit. Looks like client functionality is working. [Notice] Bootstrapped 100%: Done. I have ports 56830, 56831, 56832, and 56833 forwarded to this machine from my router/nat. I get connections on my ORPort 56830 -- though in 2-3 days, not a single client. Seems to be directory exchanges (?) or my own Tor Browser use. Isn't 2-3 days long enough to be discovered? Looks like it is listening on 60093 and 60094 for obfs3 and obfs2 instead of the intended 56832 and 56831 (the ports I have forwarded) for the purpose. Any help? Is it just a syntax error on my part (I tried using two lines for the ServerTransportListenAddr but one was automatically deleted after editing in Vidalia), or am I further off-track? Thanks a bundle :) Asa

2 2

Tor node monitoring
by Alex Beal 17 Apr '13

17 Apr '13

Hello All, I was wondering what, if any, software you use for monitoring your relays. It would be nice if I could get an email when the Tor daemon crashes, and maybe another every night telling me about bandwidth used, average speed, etc. Thanks, Alex -- For sensitive information, use my public key: http://media.usrsb.in/files/pub.asc Fingerprint: 0BCE 27F8 FBED 34C0 B936 7625 1D7D CA76 C811 1C0C

6 5

Tor Relay on DSL connection
by Jochen 16 Apr '13

16 Apr '13

Hello, I'm running a tor relay (non-exit) on DSL connection. My ISP reconnects me every 24 hours and gives me a new ip. How must tor be configured to publish it's new ip address after reconnect? Can tor daemon (linux) do this automatically or do I have to run a cron job and restart service cron at specific times?

3 2