- tor-relays - lists.torproject.org

HW-Accelerated OpenSSL & Tor not playing nicely.
by 12xBTM 05 May '15

05 May '15

Probably (and hopefully) a very obvious fix for those that aren't newbies to Linux, but I'm trying to get Hardware-Accelerated OpenSSL to work with Tor on Jessie. I've gotten the Hardware-Accelerated OpenSSL part done, but the Tor part is giving me problems. I am able to successfully compile Tor by itself, and I'm able to successfully utilize OpenSSL by itself, but getting them to work together isn't working. So, I'll give a run-down of what I've done, and where I'm stuck: Info: Linux beaglebone 3.14.39-ti-r61 #1 SMP PREEMPT Fri Apr 24 18:32:15 UTC 2015 armv7l GNU/Linux Debian 8 Console Tor 2.6.7 Information Sources: https://superuser.com/questions/881404/beaglebone-black-openssl-crypto-acce… and http://datko.net/2013/10/28/tor_cryptodev/ Step 1: Getting OpenSSL to become Hardware-Accelerated sudo apt-get install linux-image-3.14.39-ti-r61 sudo apt-get install linux-headers-3.14.39-ti-r61 wget http://download.gna.org/cryptodev-linux/cryptodev-linux-1.7.tar.gz tar zxf cryptodev-linux-1.7.tar.gz cd cryptodev-linux-1.7/ sudo make sudo make install sudo depmod -a sudo modprobe cryptodev lsmod sudo sh -c 'echo cryptodev>>/etc/modules' cd ~ wget https://www.openssl.org/source/openssl-1.0.2a.tar.gz tar zxf openssl-1.0.2a.tar.gz cd openssl-1.0.2a/ ls ./config -DHAVE_CRYPTODEV -DUSE_CRYPTDEV_DIGESTS shared sudo make sudo make install Step 2: Test OpenSSL: /usr/local/ssl/bin/openssl speed -evp aes-128-cbc Results confirm hardware acceleration is functional Step 3: Making Tor use OpenSSL Added to /etc/apt/sources.list : deb http://deb.torproject.org/torproject.org jessie main deb-src http://deb.torproject.org/torproject.org jessie main deb http://deb.torproject.org/torproject.org tor-experimental-0.2.6.x-jessie main deb-src http://deb.torproject.org/torproject.org tor-experimental-0.2.6.x-jessie main Fixed the key nonsense sudo apt-get update sudo apt-get install build-essential fakeroot devscripts sudo apt-get build-dep tor mkdir ~/debian-packages; cd ~/debian-packages sudo apt-get source tor cd tor-* And it's here where I believe the problem lies: sudo nano debian/rules Add the two lines as shown on the "guide" such that mine reads: override_dh_auto_configure: ! [ -e debian/micro-revision.i ] || cp debian/micro-revision.i src/or/micro-revision.i dh_auto_configure -- \ $(confflags) \ --enable-static-openssl \ --with-openssl-dir=/usr/local/ssl \ --prefix=/usr \ --mandir=\$${prefix}/share/man \ --infodir=\$${prefix}/share/info \ --localstatedir=/var \ --sysconfdir=/etc \ --disable-silent-rules \ --enable-gcc-warnings-advisory sudo debuild -rfakeroot -uc -us Error message after 35m: 15/359 TESTS FAILED. (0 skipped) Makefile:6429: recipe for target 'test' failed make[1]: *** [test] Error 1 make[1]: Leaving directory '/home/debian/debian-packages/tor-0.2.6.7/build' dh_auto_test: make -j1 test returned exit code 2 debian/rules:16: recipe for target 'build' failed make: *** [build] Error 2 dpkg-buildpackage: error: debian/rules build gave error exit status 2 debuild: fatal error at line 1376: dpkg-buildpackage -rfakeroot -D -us -uc failed My thoughts: I noticed on the Tor FAQ here: https://www.torproject.org/docs/faq.html.en#RelayMemory That adding the malloc flag it done using the ./configure option, while I used nano. If that's the problem, how do I use configure for adding the other flags such as OPenSSL dir and static openssl. Also, I noticed that the path I add to the configure is not quite the same as the path used to test openssl's functionality. Also, the tor confflag mentions static openssl, but the openssl ./configure talked about being shared. Also, does the ordering other confflags matter? Is it asking for a static openssl prior to learning the directory of the correct library? I'm just trying to brainstorm why I'm getting this one error. Looking at the test log, looks like there's some kind of error in the self-test of the cryptographic engine, yet it works in OpenSSL by itself? Any help would be appreciated, thanks. Super long test log: onion_handshake: cryptodev_digest_update: illegal inputs FAIL ../src/test/test.c:84: assert(! onion_skin_TAP_create(pk, &c_dh, c_buf)) [onion_handshake FAILED] bad_onion_handshake: cryptodev_digest_update: illegal inputs cryptodev_digest_update: illegal inputs cryptodev_digest_update: illegal inputs cryptodev_digest_update: illegal inputs FAIL ../src/test/test.c:158: assert(! onion_skin_TAP_create(pk, &c_dh, c_buf)) [bad_onion_handshake FAILED] onion_queues: OK ntor_handshake: OK circuit_timeout: OK rend_fns: OK geoip: OK geoip_with_pt: [forking] OK stats: [forking] OK accounting/bwlimits: [forking] OK addr/basic: OK addr/ip6_helpers: OK addr/parse: OK addr/virtaddr: OK addr/localname: OK addr/dup_ip: OK addr/sockaddr_to_str: OK addr/is_loopback: OK addr/make_null: OK address/get_if_addrs_ifaddrs: [forking] OK address/ifaddrs_to_smartlist: OK address/get_if_addrs_ioctl: [forking] OK address/ifreq_to_smartlist: OK buffer/basic: [forking] OK buffer/copy: [forking] OK buffer/pullup: [forking] OK buffer/ext_or_cmd: [forking] OK buffer/allocation_tracking: [forking] OK buffer/time_tracking: [forking] OK buffer/zlib: [forking] OK buffer/zlib_fin_with_nil: [forking] OK buffer/zlib_fin_at_chunk_end: [forking] OK cellfmt/relay_header: OK cellfmt/begin_cells: OK cellfmt/connected_cells: OK cellfmt/create_cells: OK cellfmt/created_cells: OK cellfmt/extend_cells: OK cellfmt/extended_cells: OK cellfmt/resolved_cells: OK cellfmt/is_destroy: OK cellqueue/basic: [forking] OK cellqueue/circ_n_cells: [forking] OK channel/dumpstats: [forking] OK channel/flush: [forking] OK channel/flushmux: [forking] OK channel/incoming: [forking] OK channel/lifecycle: [forking] OK channel/lifecycle_2: [forking] OK channel/multi: [forking] OK channel/queue_impossible: [forking] OK channel/queue_size: [forking] OK channel/write: [forking] OK channeltls/create: [forking] OK channeltls/num_bytes_queued: [forking] OK channeltls/overhead_estimate: [forking] OK checkdir/perms: [forking] OK circuitlist/maps: [forking] OK circuitlist/rend_token_maps: [forking] OK circuitlist/pick_circid: [forking] OK circuitmux/destroy_cell_queue: [forking] OK config/resolve_my_address: [forking] OK config/addressmap: OK config/parse_bridge_line: OK config/parse_transport_options_line: OK config/parse_transport_plugin_line: [forking] OK config/check_or_create_data_subdir: [forking] OK config/write_to_data_subdir: [forking] OK config/fix_my_family: OK container/smartlist_basic: OK container/smartlist_strings: OK container/smartlist_overlap: OK container/smartlist_digests: OK container/smartlist_join: OK container/smartlist_ints_eq: OK container/bitarray: OK container/digestset: OK container/strmap: OK container/pqueue: OK container/order_functions: OK container/di_map: OK container/fp_pair_map: OK control/bucket_note_empty: OK control/bucket_millis_empty: OK control/sum_up_cell_stats: OK control/append_cell_stats: OK control/format_cell_stats: OK crypto/formats: OK crypto/rng: OK crypto/aes_AES: [forking] OK crypto/aes_EVP: [forking] OK crypto/sha: OK crypto/pk: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_crypto.c:427: assert(128 OP_EQ crypto_pk_public_encrypt(pk2, data1, sizeof(data1), "Hello whirled.", 15, PK_PKCS1_OAEP_PADDING)): 128 vs -1 [pk FAILED] crypto/pk_fingerprints: [forking] OK crypto/digests: OK crypto/dh: OK crypto/aes_iv_AES: [forking] OK crypto/aes_iv_EVP: [forking] OK crypto/base32_decode: OK crypto/kdf_TAP: OK crypto/hkdf_sha256: OK crypto/curve25519_impl: OK crypto/curve25519_impl_hibit: OK crypto/curve25519_wrappers: OK crypto/curve25519_encode: OK crypto/curve25519_persist: OK crypto/ed25519_simple: OK crypto/ed25519_test_vectors: OK crypto/ed25519_encode: OK crypto/ed25519_convert: OK crypto/ed25519_blinding: OK crypto/ed25519_testvectors: OK crypto/siphash: OK dir/nicknames: [forking] OK dir/formats: [forking] OK dir/routerparse_bad: OK dir/extrainfo_parsing: OK dir/parse_router_list: [forking] OK dir/load_routers: [forking] OK dir/load_extrainfo: [forking] OK dir/versions: [forking] OK dir/fp_pairs: [forking] OK dir/split_fps: OK dir/measured_bw_kb: [forking] OK dir/measured_bw_kb_cache: [forking] OK dir/param_voting: [forking] OK dir/v3_networkstatus: [forking] OK dir/random_weighted: OK dir/scale_bw: OK dir/clip_unmeasured_bw_kb: [forking] OK dir/clip_unmeasured_bw_kb_alt: [forking] OK dir/fmt_control_ns: OK dir/http_handling: OK dir/purpose_needs_anonymity: OK dir/fetch_type: OK dir/packages: OK dir/md/cache: [forking] OK dir/md/broken_cache: [forking] OK dir/md/generate: OK dir/md/parse: OK dir/md/reject_cache: [forking] OK entryconn/rewrite_basic: [forking] OK entryconn/rewrite_bad_dotexit: [forking] OK entryconn/rewrite_automap_ipv4: [forking] OK entryconn/rewrite_automap_ipv6: [forking] OK entryconn/rewrite_cached_dns_ipv4: [forking] OK entryconn/rewrite_cached_dns_ipv6: [forking] OK entryconn/rewrite_unmapped_virtual: [forking] OK entryconn/rewrite_mapaddress: [forking] OK entryconn/rewrite_reject_internal_reverse: [forking] OK entryconn/rewrite_automap_exit: [forking] OK entryconn/rewrite_mapaddress_exit: [forking] OK entryconn/rewrite_mapaddress_automap_onion: [forking] OK entryconn/rewrite_mapaddress_automap_onion2: [forking] OK entryconn/rewrite_mapaddress_automap_onion3: [forking] OK entryconn/rewrite_mapaddress_automap_onion4: [forking] OK entrynodes/entry_is_time_to_retry: [forking] OK entrynodes/choose_random_entry_no_guards: [forking] OK entrynodes/choose_random_entry_one_possibleguard: [forking] OK entrynodes/populate_live_entry_guards_1guard: [forking] OK entrynodes/populate_live_entry_guards_3guards: [forking] OK entrynodes/entry_guards_parse_state_simple: [forking] OK entrynodes/entry_guards_parse_state_pathbias: [forking] OK entrynodes/entry_guards_set_from_config: [forking] OK entrynodes/entry_is_live: [forking] OK guardfraction/parse_guardfraction_file_bad: [forking] OK guardfraction/parse_guardfraction_file_good: [forking] OK guardfraction/parse_guardfraction_consensus: [forking] OK guardfraction/get_guardfraction_bandwidth: [forking] OK guardfraction/should_apply_guardfraction: [forking] OK extorport/id_map: [forking] OK extorport/write_command: [forking] OK extorport/init_auth: [forking] OK extorport/cookie_auth: [forking] OK extorport/cookie_auth_testvec: [forking] OK extorport/handshake: [forking] OK hs/hs_desc_event: [forking] OK hs/pick_tor2web_rendezvous_node: [forking] OK hs/pick_bad_tor2web_rendezvous_node: [forking] OK introduce/early_parse_v0: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [early_parse_v0 FAILED] introduce/early_parse_v1: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [early_parse_v1 FAILED] introduce/early_parse_v2: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [early_parse_v2 FAILED] introduce/early_parse_v3: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0)cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [early_parse_v3 FAILED] introduce/decrypt_v0: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [decrypt_v0 FAILED] introduce/decrypt_v1: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [decrypt_v1 FAILED] introduce/decrypt_v2: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [decrypt_v2 FAILED] introduce/decrypt_v3: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0)cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [decrypt_v3 FAILED] introduce/late_parse_v0: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [late_parse_v0 FAILED] introduce/late_parse_v1: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [late_parse_v1 FAILED] introduce/late_parse_v2: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [late_parse_v2 FAILED] introduce/late_parse_v3: cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0)cryptodev_digest_update: illegal inputs FAIL ../src/test/test_introduce.c:381: assert(r >= 0) FAIL ../src/test/test_introduce.c:305: assert(r > 0) [late_parse_v3 FAILED] nodelist/node_get_verbose_nickname_by_id_null_node: [forking] OK nodelist/node_get_verbose_nickname_not_named: [forking] OK oom/circbuf: [forking] OK oom/streambuf: [forking] OK options/validate: [forking] OK policy/router_dump_exit_policy_to_string: OK policy/general: OK pt/parsing: OK pt/protocol: OK pt/get_transport_options: [forking] OK pt/get_extrainfo_string: [forking] OK pt/configure_proxy: [forking] OK pt/get_pt_proxy_uri: [forking] OK relay/append_cell_to_circuit_queue: [forking] OK relaycell/resolved: [forking] OK replaycache/alloc: OK replaycache/badalloc: OK replaycache/free_null: OK replaycache/miss: OK replaycache/hit: OK replaycache/age: OK replaycache/elapsed: OK replaycache/noexpire: OK replaycache/scrub: OK replaycache/future: OK replaycache/realtime: OK routerkeys/write_fingerprint: [forking] OK routerlist/initiate_descriptor_downloads: OK routerlist/launch_descriptor_downloads: OK routerset/routerset_new: [forking] OK routerset/routerset_get_countryname: [forking] OK routerset/routerset_is_list: [forking] OK routerset/routerset_needs_geoip: [forking] OK routerset/routerset_is_empty: [forking] OK routerset/routerset_contains__null_set_or_null_set_list: [forking] OK routerset/routerset_contains__set_and_nickname: [forking] OK routerset/routerset_contains__set_and_null_nickname: [forking] OK routerset/routerset_contains__set_and_no_nickname: [forking] OK routerset/routerset_contains__set_and_digest: [forking] OK routerset/routerset_contains__set_and_no_digest: [forking] OK routerset/routerset_contains__set_and_null_digest: [forking] OK routerset/routerset_contains__set_and_addr: [forking] OK routerset/routerset_contains__set_and_no_addr: [forking] OK routerset/routerset_contains__set_and_null_addr: [forking] OK routerset/routerset_contains__countries_no_geoip: [forking] OK routerset/routerset_contains__countries_geoip: [forking] OK routerset/routerset_add_unknown_ccs__only_flag_and_no_ccs: [forking] OK routerset/routerset_add_unknown_ccs__creates_set: [forking] OK routerset/routerset_add_unknown_ccs__add_unknown: [forking] OK routerset/routerset_add_unknown_ccs__add_a1: [forking] OK routerset/routerset_contains_extendinfo: [forking] OK routerset/routerset_contains_router: [forking] OK routerset/routerset_contains_routerstatus: [forking] OK routerset/routerset_contains_node__none: [forking] OK routerset/routerset_contains_node__routerinfo: [forking] OK routerset/routerset_contains_node__routerstatus: [forking] OK routerset/routerset_get_all_nodes__no_routerset: [forking] OK routerset/routerset_get_all_nodes__list_with_no_nodes: [forking] OK routerset/routerset_get_all_nodes__list_flag_not_running: [forking] OK routerset/routerset_get_all_nodes__list: [forking] OK routerset/routerset_get_all_nodes__nodelist_with_no_nodes: [forking] OK routerset/routerset_get_all_nodes__nodelist_flag_not_running: [forking] OK routerset/routerset_refresh_counties__geoip_not_loaded: [forking] OK routerset/routerset_refresh_counties__no_countries: [forking] OK routerset/routerset_refresh_counties__one_valid_country: [forking] OK routerset/routerset_refresh_counties__one_invalid_country: [forking] OK routerset/routerset_union__source_bad: [forking] OK routerset/routerset_union__one: [forking] OK routerset/routerset_parse__malformed: [forking] OK routerset/routerset_parse__valid_hexdigest: [forking] OK routerset/routerset_parse__valid_nickname: [forking] OK routerset/routerset_parse__get_countryname: [forking] OK routerset/routerset_parse__policy: [forking] OK routerset/routerset_subtract_nodes: [forking] OK routerset/routerset_subtract_nodes__null_routerset: [forking] OK routerset/routerset_to_string: [forking] OK routerset/routerset_equal__empty_empty: [forking] OK routerset/routerset_equal__empty_not_empty: [forking] OK routerset/routerset_equal__differing_lengths: [forking] OK routerset/routerset_equal__unequal: [forking] OK routerset/routerset_equal__equal: [forking] OK routerset/routerset_free__null_routerset: [forking] OK routerset/routerset_free: [forking] OK scheduler/channel_states: [forking] OK scheduler/compare_channels: [forking] OK scheduler/initfree: [forking] OK scheduler/loop: [forking] OK scheduler/queue_heuristic: [forking] OK socks/4_unsupported_commands: [forking] OK socks/4_supported_commands: [forking] OK socks/5_unsupported_commands: [forking] OK socks/5_supported_commands: [forking] OK socks/5_no_authenticate: [forking] OK socks/5_auth_before_negotiation: [forking] OK socks/5_authenticate: [forking] OK socks/5_authenticate_with_data: [forking] OK socks/5_malformed_commands: [forking] OK status/count_circuits: [forking] OK status/secs_to_uptime: [forking] OK status/bytes_to_usage: [forking] OK status/log_heartbeat__fails: [forking] OK status/log_heartbeat__simple: [forking] OK status/log_heartbeat__not_in_consensus: [forking] OK status/log_heartbeat__calls_log_accounting: [forking] OK status/log_heartbeat__packaged_cell_fullness: [forking] OK status/log_heartbeat__tls_write_overhead: [forking] OK util/time: OK util/parse_http_time: OK util/config_line: OK util/config_line_quotes: OK util/config_line_comment_character: OK util/config_line_escaped_content: OK util/expand_filename: OK util/escape_string_socks: OK util/string_is_key_value: OK util/strmisc: OK util/pow2: OK util/gzip: OK util/datadir: OK util/memarea: OK util/control_formats: OK util/mmap: OK util/sscanf: OK util/format_time_interval: OK util/path_is_relative: OK util/strtok: OK util/di_ops: OK util/round_to_next_multiple_of: OK util/laplace: OK util/strclear: OK util/find_str_at_start_of_line: OK util/string_is_C_identifier: OK util/asprintf: OK util/listdir: OK util/parent_dir: OK util/ftruncate: OK util/exit_status: OK util/fgets_eagain: OK util/format_hex_number: OK util/format_dec_number: OK util/join_win_cmdline: OK util/split_lines: OK util/n_bits_set: OK util/eat_whitespace: OK util/sl_new_from_text_lines: OK util/envnames: OK util/make_environment: OK util/set_env_var_in_sl: OK util/read_file_eof_tiny_limit: OK util/read_file_eof_one_loop_a: OK util/read_file_eof_one_loop_b: OK util/read_file_eof_two_loops: OK util/read_file_eof_two_loops_b: OK util/read_file_eof_zero_bytes: OK util/write_chunks_to_file: OK util/mathlog: OK util/weak_random: OK util/socket: [forking] OK util/socketpair: [forking] OK util/socketpair_ersatz: [forking] OK util/max_mem: OK util/hostname_validation: OK util/ipv4_validation: OK util/logging/sigsafe_err_fds: [forking] OK util/logging/sigsafe_err: [forking] OK util/thread/basic: [forking] OK util/thread/conditionvar: [forking] OK util/thread/conditionvar_timeout: [forking] OK

3 8

T-shirts and Confirming Relay Control
by Matthew Finkel 05 May '15

05 May '15

Hi Ops, We recently began responding to t-shirt requests again. Sorry for the long silence. There's been a lot happening around here but not enough time or people to do everything, so the t-shirt requests simply remained untouched. But, despite the overload, t-shirts are important because they are a small token of our thanks and appreciation for making the network what it is today. We responded to around 70 t-shirt requests from relay operators in April, which comprised all requests for which we could verify (within reason) the request came from the person who controlled the qualifying relay. We still have another 20 requests where the requestor is not obviously the owner of the relay. Currently the content of a relay's Contact field is used, but this does not always provide enough (or any) information. For this case, we need an authentication mechanism which proves control of the relay but is something relay operators won't mind running. My currently plan is to ask relay operators to sign the fingerprint file which tor creates. The major disadvantage of this method is that it must be run as root (or a user with access to tor's data directory). The following process is the current plan, but does anyone have a better idea? Does it seem logical? ------------------------------------------------------------ When we receive a t-shirt request from someone who isn't obviously in control of the relay, we ask them to sign their fingerprint file with a unique salt. Assuming the path to their data dir is /var/lib/tor, we ask them to run: $ (echo -n "salt "; cat /var/lib/tor/fingerprint) | openssl sha256 \ -binary | openssl pkeyutl -inkey /var/lib/tor/keys/secret_id_key \ -sign -pkeyopt digest:sha256 -pkeyopt rsa_padding_mode:pss \ -pkeyopt rsa_pss_saltlen:32 | openssl base64 > signed_fingerprint They send us both /var/lib/tor/fingerprint and signed_fingerprint. When we receive them, we confirm the fingerprint in the fingerprint file matches the qualifying relay. Then we retrieve the relay's public key from its descriptor and convert it into pkcs#8 format using: $ openssl rsa -pubin -in pubkey_pkcs1 -RSAPublicKey_in -out pubkey and then we verify the sig using following commands: $ (echo -n "salt "; cat fingerprint) | openssl sha256 -binary | \ openssl pkeyutl -pubin -verify -inkey pubkey -sigfile \ $(OUT=/tmp/signed_fingerprint_bin; base64 -d signed_fingerprint > \ ${OUT}; echo ${OUT}) -pkeyopt digest:sha256 -pkeyopt \ rsa_padding_mode:pss -pkeyopt rsa_pss_saltlen:32; rm \ /tmp/signed_fingerprint_bin; This should yield "Signature Verified Successfully". ------------------------------------------------------------ Another disadvantage of this is PSS wasn't implemented in openssl's apps until 1.0.1. I wonder how many relays are running on servers which are still using openssl 0.9.8 (and 1.0.0?). For these servers we can fallback on pkcs#1 v1.5 signatures. ------------------------------------------------------------ The signature can be created using a command similar to the one above: $ (echo -n "salt "; cat /var/lib/tor/fingerprint) | openssl dgst \ -sha256 | openssl rsautl -inkey /var/lib/tor/keys/secret_id_key \ -sign | openssl base64 > signed_fingerprint Again, they provide /var/lib/tor/fingerprint and signed_fingerprint, and we verify using: $ test "$(openssl base64 -d -in signed_fingerprint | openssl rsautl \ -pubin -verify -inkey pubkey)" = "$((echo -n "salt "; cat \ fingerprint) | openssl dgst -sha256)"; echo $? In addition, again, we confirm the fingerprint in the fingerprint file matches the fingerprint of the qualifying relay. ------------------------------------------------------------ Originally I used a few bashisms which made these simpler, but for this I suspect portability is important. Sorry this is a bit long. Thanks, Matt

11 19

Enabling obfs4 and obfs3 on 80 and 443
by R-one 05 May '15

05 May '15

I have recently set up a bridge and was reading some old emails on the list. I found some instructions from s7r on setting up obfs4 and obfs3: > Sample torrc entry for enabling obfs4 and obfs3: > ExtORPort auto > ServerTransportPlugin obfs3,obfs4 exec /usr/bin/obfs4proxy > ServerTransportListenAddr obfs3 [::]:port > ServerTransportListenAddr obfs4 [::]:port > > To make the bridge even better, you can bind obfs3 and obfs4 to lower > ports (< 1024), if you have them free, such as obfs3 on 80 and obfs4 > on 443 (for example). This seemed like a good idea (I am not running a web server). I am running tor 0.2.4.27, which does not seem to support ExtORPort. From some other recommended bridge setup I had previously set ORPort to 443. I tried changing my config to: ORPort auto ServerTransportListenAddr obfs3 0.0.0.0:80 ServerTransportListenAddr obfs4 0.0.0.0:443 (and doing the capabilities stuff, of course). This didn't work -- obfs4 complained that 443 was in use (is that because I had previously set it for ORPort?). So, for now, I have set obfs4 to a random high port. I will admit to being pretty confused about the recommended bridge setting for ORPort and the obfs ports (and what ExtORPort does differently). Does anyone have a recommendation for what I should do? Do I need to upgrade to tor 0.2.5?

2 1

Tor Relays Network Survey
by Zoe White 04 May '15

04 May '15

Hello everyone, I am doing a research project called “Understanding Anonymous Network” conducted at the University of Illinois at Urbana-Champaign. The purpose of this project is to investigate what motivates people to participate in Tor project and to run the relay nodes. We also want to know what obstacles may hinder people to run relay(s). Our aim is to increase people’s participation in Tor network through understanding motivation. Your participation will help us have a better understanding about this issue. This survey will take approximately 15 minutes of your time. If you run Tor nodes and are willing to participate in this research project, please click the following link and start the survey! *https://uiuc.qualtrics.com/SE/?SID=SV_9GkkX5zGEkjQhx3* <https://uiuc.qualtrics.com/SE/?SID=SV_9GkkX5zGEkjQhx3> Thank you very much!!

4 6

Re: [tor-relays] T-shirts and Confirming Relay Control
by teor 04 May '15

04 May '15

> Date: Mon, 04 May 2015 13:06:51 +0200 > From: Markus Hitter <mah(a)jump-ing.de> … > > The more demanding part of this is to collect the addresses, especially the software to do so. An application which formats them ready for printing, calculates the stamp required, perhaps also prints some customs stickers depending on destination. Here volunteers can easily help and there's no need to hide such discussions, because such software doesn't require the real data, can be written/tested with dummy data instead. All the trusted person (you) has to do is to run this software on the real data and hit the "print" button. Your post office or shipping company might have software like this already - and if it's done using their software, getting the stamps and stickers right is their responsibility, not yours. Of course, this software might not be free, in either sense of the word. teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

2 1

Determining geographical locations for a new exit relay would help most
by Seth 04 May '15

04 May '15

I'm standing up a new exit relay on the VULTR network. How would a person go about determining which location is in most need of additional exit relay capacity? Available locations: https://www.vultr.com/locations/ * Miami, Florida * Chicago, Illinois * New York / New Jersey * Dallas, Texas * Seattle, Washington * Atlanta, Georgia * Los Angeles, California * Silicon Valley, California * (AU) Sydney, Australia * (Asia) Tokyo, Japan * (EU) Amsterdam, NL * (EU) London, UK * (EU) Paris, France * (EU) Frankfurt, DE Also, curious to hear people's thoughts on any potential jurisdictional arbitrage benefits to be gleaned by choosing a location other than ones country of residence or citizenship. For the sake of argument, consider a VULTR account opened by U.S. citizen residing in the U.S. Choopa LLC (VULTR parent company) is also a US based company. http://start.cortera.com/company/research/k5o8lvm2j/choopa-llc/

4 12

Why can't I see authorities bandwith stats
by Dedalo 04 May '15

04 May '15

Hi, I was making some changes in my relay configuration and I made some queries in GLOBE and ATLAS and something happened. I noticed that all authorities are not showing bandwidth stats from the last week and I was wondering why. Regards, Dedalo. -- twitter: @SeguridadBlanca Github: Dedal0 Blog: https://blog.dedalo.in

2 1

Re: [tor-relays] T-shirts and Confirming Relay Control
by JovianMallard 04 May '15

04 May '15

Matt, Inspired by the options to confirm domain ownership with Google, Could you ask the relay operator to include a randomly generated (by you) token in their contact field? It may take a while to propagate and it requires action on the operator's part, but it's not difficult and I expect it provides the assurance you need. > On 05/03/2015 04:20 PM, Matthew Finkel wrote: >> On Sun, May 03, 2015 at 12:05:49PM -0700, Aaron Hopkins wrote: >>> On Sun, 3 May 2015, Matthew Finkel wrote: > >>> Or as Robert suggests, just send verification mail to the listed contact >>> address of the relay. If they don't list one on their config, find an >>> alternate verification mechanism like e-mailing whois contacts for the IP or >>> domain name, or refuse the request. >> >> I'd prefer not denying them a t-shirt because they don't want to publish >> an email address publically, but using whois seems like a stretch and >> usually ends at the hosting provider instead of the operator. >

2 1

Re: [tor-relays] T-shirts and Confirming Relay Control
by teor 04 May '15

04 May '15

> Date: Sun, 3 May 2015 17:44:39 +0000 > From: Matthew Finkel <Matthew.Finkel(a)gmail.com> > … > > Another disadvantage of this is PSS wasn't implemented in openssl's > apps until 1.0.1. I wonder how many relays are running on servers which > are still using openssl 0.9.8 (and 1.0.0?). For these servers we can > fallback on pkcs#1 v1.5 signatures. OS X still ships with OpenSSL 0.9.8 by default. But Darwin is such a small fraction of the network, and it's less likely that a Darwin server would push enough data to get a t-shirt unless it had an OpenSSL version with aes-ni. teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

1 0

Drop in relay count
by Linus Nordberg 03 May '15

03 May '15

Hi, Looking at the graphs showing the number of relays in the network it seems like we've lost about 500 (-7%) relays since the beginning of this year. https://metrics.torproject.org/networksize.html?graph=networksize&start=201… https://metrics.torproject.org/networksize.html?graph=networksize&start=201… Looking at the graphs showing the total relay bandwidth of the network it seems like the advertised bandwidth has increased with about 25 Mbps (+23%). https://metrics.torproject.org/bandwidth.html?graph=bandwidth&start=2015-01… https://metrics.torproject.org/bandwidth.html?graph=bandwidth&start=2012-01… Seems a bit contradictory at first sight. A guess would be that a lower number of fast relays have replaced a higher number of slow ones but I haven't looked into it more. Anyone who's looked into this? And can back up their theory with some numbers. Thanks, Linus

4 5

Re: [tor-relays] tor-relays Digest, Vol 52, Issue 1
by aredocilla＠gmail.com 02 May '15

02 May '15

> Date: Sat, 2 May 2015 15:52:07 +0800 > From: Geo Rift <tim.cochrane.laptop(a)gmail.com> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Determining geographical locations for a new > exit relay would help most > Message-ID: > <CAO3ZnMfdf9Q6FUHXhZtYAy1orS607DA_SYDuQi08p9Z7YKJVgQ(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > I would love to see some more nodes in Australia. I'm located in Perth > and the speed of the network it horrible. Not usable for day to day > internet which is unfortunate, hopefully it will pick up soon. Unless you've been really messing with your configuration, you're likely to end up hopping out of your home country at least once per circuit anyway. And if the network is slow, you'd want your traffic to get out of there as soon as possible; no/little sense adding a relay in a slow network area. Exit relay positioning is more dependent on filtering and network diversity rather than geographical proximity; I can only see that being helpful for guard relays. That said, if we're low on Australian relays it'd be good to get more there. I believe both UK and Australia keep bouncing around ideas for legally-required net filtering; that's the only thing I'd keep in mind other than speed when choosing between them. -- PGP key available on request

1 0

Effectively donating bandwidth
by Curtis Gagliardi 30 Apr '15

30 Apr '15

I'm running a relay with the extra bandwidth on my VPS, but I'm unsure if it's optimally configured. I have 2.5TB of bandwidth I want to use every month. Given that, how do I configure my relay in the most helpful way? The docs mention dividing my bandwidth by 30 and setting an accounting max of 1 day. It also suggests "You might also consider rate limiting to spread your usefulness over more of the day". What not use an accouting period of a month and spread it out over the full month? Spreading it out feels like the right thing to do, but is it actually the most helpful? Maybe burning my bandwidth is faster bursts is more helpful. If spreading it over the month using a low bandwidth rate and a monthly accounting period is ideal, is there a better way to configure it than busting out a calculator and coverting TB/month to KB/s? How should I determine my BandwidthBurstRate? I understand what it is, but should it be defined in relation to my bandwidth rate? Thanks in advance, Curtis Gagliardi

2 2

Re: [tor-relays] running multiple bridges on one machine?
by teor 29 Apr '15

29 Apr '15

> On 29 Apr 2015, at 22:00 , tor-relays-request(a)lists.torproject.org wrote: > > Date: Tue, 28 Apr 2015 17:45:44 +0200 > From: yl <tor(a)yl.ms> > > Am 28.04.2015 um 03:30 schrieb syndikal: >> let's begin: is it possible to run 5 bridges on one low-end VPS? each >> bridge would be hosted on a different IP address from five different /24 >> IP blocks, so that's not an issue. would i have to use multiple Tor >> processes, and would 5 processes be too much for a 2-core VPS with >> 256mb memory? >> >> also, how much bandwidth does a bridge normally burn through per month? >> on said VPS, the economical choice is to provide 200gb bandwidth per >> month. if that is not sufficient, the offer isn't financially feasible. > > I run a tor relay on some Atom processor, the bottleneck is the missing > AES-NI I think, however on 100MBit/s it only makes 35MBit/s with one CPU > core being loaded 100% and the other 3 at ~10%. My relay makes a few > TB/month like that, so I guess it is still good to keep it running. yl, have you tried running a second tor instance on another pair of ports? (onion / directory) The second instance would be able to use another of the processors on your multiprocessor machine. (Unfortunately, tor multithreading only offloads some of the work.) There is currently a limit of two instances per IP address, but if you have 2 IP addresses, you could potentially run 4 instances, one instance per processor. teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

1 0

running multiple bridges on one machine?
by syndikal 28 Apr '15

28 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 hello relay operators! i've asked this question on IRC once or twice, but it seems the right people aren't online/active when i am. i think i might be able to get a better audience to answer my questions here on the mailing lists. let's begin: is it possible to run 5 bridges on one low-end VPS? each bridge would be hosted on a different IP address from five different /24 IP blocks, so that's not an issue. would i have to use multiple Tor processes, and would 5 processes be too much for a 2-core VPS with 256mb memory? also, how much bandwidth does a bridge normally burn through per month? on said VPS, the economical choice is to provide 200gb bandwidth per month. if that is not sufficient, the offer isn't financially feasible. thanks for all you do! - -- @syndikal A9FF 2FE3 A171 FE53 AEC3 A0F9 72B5 44E0 4417 11B2 twitter.com/syndikal -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVPuKmAAoJEHK1ROBEFxGyfUQP/irH1HzKPCe+t9TFSMignsRq oX5tK6YfInQ7vmfdhpPyHodM6DneeC1uBVdY6+qyJ6g3Ef5JXblSua+2zqJe8mlI rlwL9ll+i4tYSquqpaht3dWU1xY/UoqnlwCSO8+xaCz0zYBmOafib1MHI8nCDblp Y1PXMVWs3nhaXP/ev8JS3y8HuVeVy03lRF8pAaxKJmFI5YZJpNqHO/gVXTwU0O6M OrlqPT/YPmN/cD00TrnT5k+dVEHIPzEt7vK20NlUfCTS7vLOZync+jwRBYPzS6es fFq7C/gTP3oxyx6RIGLXpHEtKmvUwQeC89GKrgrDfb0EynX7bZ+jcvzXBCq5TPFz rgz19ogAbDZ167FshkVhMc+twfhkaq1FN2ADIHF7iIFLd6z93Img3IVMk+i2nijy lb4CtfHFqhJKSxuAfUYVFHx5GnC2u37gOCKdF+ZOCtpOAyP7ozrSwVYLY+OjsPf2 7F9dq22x8QxOdSccyK4lrmyl0SZpliMDCIoJk4IvJT2elqStntwH/Ecur2I48mWv UvPcwUEbsUhZg/u3xDkuvhB5zcVYB01gqbFSr8N7nYgMgx9Ww7lVVMmj+2ADQS9e ttOHmck50ewjz/EVN/xbWcemdGyiNl1M0aPyoysWgn/8TZ12TLhAL1jgJxOJFE99 7K8kTak9an5FOf+RbpY6 =eeGb -----END PGP SIGNATURE-----

4 3

Re: [tor-relays] Tor Cloud/AWS relay set up but no Tor installed
by aredocilla＠gmail.com 28 Apr '15

28 Apr '15

Hi there, After a long month of not having time for this, I've got it working thanks to Sina's help. I've attached patches to the ec2-prep.sh script that should make it work again (nothing extensive, basically just what Sina pointed out plus something about ExtORPort I saw it complaining about in the log. Bridge is now up. :) Best wishes, allicoder On Sun, Mar 22, 2015 at 10:51:42AM +0000, tor-relays-request(a)lists.torproject.org wrote: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Re: IPv6 HiddenServicePort (teor) > 2. Tor Cloud/AWS relay set up but no Tor installed > (aredocilla(a)gmail.com) > 3. Re: Tor Cloud/AWS relay set up but no Tor installed (SiNA Rabbani) > 4. Tor-Tshirts (Nchinda Nchinda) > 5. Re: Tor-Tshirts (Roger Dingledine) > > Message: 2 > Date: Sun, 22 Mar 2015 03:10:53 +0000 > From: aredocilla(a)gmail.com > To: tor-relays(a)lists.torproject.org > Subject: [tor-relays] Tor Cloud/AWS relay set up but no Tor installed > Message-ID: <20150322031053.GB5948@MadHatter> > Content-Type: text/plain; charset=us-ascii > > Hello, > > I've been trying to set up a tor relay on AWS using the free tier using the > instructions in various places (e.g. https://cloud.torproject.org/, > https://www.fak3r.com/2012/08/11/howto-run-a-tor-node-in-the-cloud-for-free/) > But sshing in from my PC shows clearly that not only is tor not running, it's > not even installed! > > ubuntu@ip-172-31-28-207:~$ aptitude show tor > Package: tor > State: not installed > Version: 0.2.5.11-1~precise+1 > Priority: optional > Section: net > ... > > ubuntu@ip-172-31-28-207:~$ ps -ely | grep tor > ubuntu@ip-172-31-28-207:~$ ls /var/log > alternatives.log auth.log btmp dist-upgrade dmesg.0 dmesg.2.gz fsck landscape mail.err news udev unattended-upgrades wtmp > apt boot.log cloud-init.log dmesg dmesg.1.gz dpkg.log kern.log lastlog mail.log syslog ufw.log upstart > > Has something changed, and the images no longer include tor on start-up (I made > sure I followed the gist of the cloud.torproject.org steps, given that the > interface has changed significantly; even went to the previous page from the > linked one to check that the AMI thing mentioned tor)? I've noticed various > people have posted online saying it's not safe to run Tor on cloud services - > has the image been deleted because of this? I wanted to try it anyway because > the main torproject website still says in several places that running a relay > on AWS is A Good Thing. > > Or did I just do something wrong? > > Best wishes, > allicoder. > > -- > PGP key available on request > > > ------------------------------ > > Message: 3 > Date: Sun, 22 Mar 2015 04:52:34 +0000 (UTC) > From: SiNA Rabbani <sina(a)redteam.net> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Tor Cloud/AWS relay set up but no Tor > installed > Message-ID: > <1101716784.98280.1426999954497.JavaMail.zimbra(a)redteam.net> > Content-Type: text/plain; charset=utf-8 > > Hi allicoder, > > The images on Tor Cloud website have not been updated for a while. The project is lacking someone > that can keep it up to date. I tried to take on the responsibility but so far I have failed to dedicate > the necessary time. Sorry for the bad experience. > > As far as the specific problem with the Cloud image itself, there is a script that is supposed to install the relay > on first boot. See /etc/rc.local. > > You can also find that script here: https://gitweb.torproject.org/tor-cloud.git/plain/ec2-prep.sh > > There are a couple of issues with the script itself that I noticed immediately: > 1) the harcoded pgp key is expired > 2) the debian experimental repository is returning a 404 > W: Failed to fetch http://deb.torproject.org/torproject.org/dists/experimental-precise/main/bi… 404 Not Found [IP: 38.229.72.16 80] > > If you wish to do some trouble-shooting, try to get these commands to run without any errors: > sudo apt-get -y update > sudo apt-get -y upgrade > sudo bash /etc/ec2-prep.sh bridge > > Finally, now that you have a running image and ssh access, you can just follow the Tor relay installations here: > https://www.torproject.org/docs/debian.html.en > > I apologize for the inconvenience and thank you for running a relay. > > All the best, > Sina > > > > > "Be the change that you wish to see in the world." - Mahatma Gandhi > > ----- On Mar 21, 2015, at 11:10 PM, aredocilla(a)gmail.com wrote: > > > Hello, > > > > I've been trying to set up a tor relay on AWS using the free tier using the > > instructions in various places (e.g. https://cloud.torproject.org/, > > https://www.fak3r.com/2012/08/11/howto-run-a-tor-node-in-the-cloud-for-free/) > > But sshing in from my PC shows clearly that not only is tor not running, it's > > not even installed! > > > > ubuntu@ip-172-31-28-207:~$ aptitude show tor > > Package: tor > > State: not installed > > Version: 0.2.5.11-1~precise+1 > > Priority: optional > > Section: net > > ... > > > > ubuntu@ip-172-31-28-207:~$ ps -ely | grep tor > > ubuntu@ip-172-31-28-207:~$ ls /var/log > > alternatives.log auth.log btmp dist-upgrade dmesg.0 dmesg.2.gz > > fsck landscape mail.err news udev unattended-upgrades wtmp > > apt boot.log cloud-init.log dmesg dmesg.1.gz dpkg.log > > kern.log lastlog mail.log syslog ufw.log upstart > > > > Has something changed, and the images no longer include tor on start-up (I made > > sure I followed the gist of the cloud.torproject.org steps, given that the > > interface has changed significantly; even went to the previous page from the > > linked one to check that the AMI thing mentioned tor)? I've noticed various > > people have posted online saying it's not safe to run Tor on cloud services - > > has the image been deleted because of this? I wanted to try it anyway because > > the main torproject website still says in several places that running a relay > > on AWS is A Good Thing. > > > > Or did I just do something wrong? > > > > Best wishes, > > allicoder. > > > > -- > > PGP key available on request > > _______________________________________________ > > tor-relays mailing list > > tor-relays(a)lists.torproject.org > > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > ------------------------------ > > End of tor-relays Digest, Vol 50, Issue 31 > ****************************************** -- PGP key available on request

1 0

Installing obfs4 on Raspberry Pi bridge
by jchase 25 Apr '15

25 Apr '15

Hello, Thanks, everyone, for all the help. Obfs4proxy is up and running on a Pi2. Although the information on the subject is scattered across several issues on this list, I hope others can use it to build some bridges! http://www.zipplet.co.uk/index.php/content/raspberrypi_golang was a useful page on getting go 1.2 or higher installed on a Pi2. Thanks again, J Chase > Message: 1 > Date: Thu, 23 Apr 2015 20:42:42 +0000 > From: Yawning Angel <yawning(a)schwanenlied.me> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge > Message-ID: <20150423204242.65bed2f9(a)schwanenlied.me> > Content-Type: text/plain; charset="us-ascii" > > On Thu, 23 Apr 2015 19:53:55 +0000 > jchase <jchase(a)riseup.net> wrote: >> Hello, >> When I run >> >> $ go get git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy >> $ sudo cp $GOPATH/bin/obfs4proxy /usr/local/bin >> >> on a laptop running linuxmint/ubuntu it produces a nice binary >> executable. Unfortunately it doesn't work to copy it to the Pi2, >> because it's not an ARM binary. >> When I run the same script on the Pi2 I get the following error >> messages: >> >> go get git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy >> # git.torproject.org/pluggable-transports/obfs4.git/common/ntor >> /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/common/ntor/ntor.go:272: >> undefined: sha256.Sum256 >> >> [snip] >> >> Any idea how I can get it cleanly on a Pi2? > > This is covered in the README.md: >> * Go 1.2.0 or later. Prior versions of Go (Eg: 1.0.2) are missing >> certain important parts of the runtime library like a SHA256 >> implementation. > > Go 1.2 was released on December 1, 2013, so I'm not particularly > inclined to support older versions, especially since it means > re-implementing parts of the standard runtime library. > > Regards, >

1 0

Subpoena received
by Tyler Durden 24 Apr '15

24 Apr '15

Hi I just wanted to let you know that Washington sent us a subpoena regarding one of our exit nodes in Romania. They want to know the real IP behind the Tor Network. I mailed them what Tor is and why I can't help them in identifying this person. Nevertheless I will give you the link to the full subpoena. Maybe you guys find it interesting. I will forward the subpoena to our lawyer as well. https://mega.co.nz/#!ilIjlZSb!-deirKharWaDtp_UMxhev58E14zeouyoWUbzxeWPvEQ Greetings -- Sam Grüneisen - President Frënn vun der Ënn A.S.B.L. enn.lu

16 28

Relay Consensus Weight
by Marco Morgia 24 Apr '15

24 Apr '15

Hello, on friday my realay's Consensus Weight felt down suddenly to 20 and the its bandwidth is not used anymore (https://atlas.torproject.org/#details/94212674A2C6AEBF77354D959D464E49BC878…) I don't understand why, as nothing is changed in its configuration. And, I don't know if it's related, but I noticed that the tor network has slow down in the last days and some times it's very difficult to use it. Thanks for your help, Marco ____________________________________________________________ Receive Notifications of Incoming Messages Easily monitor multiple email accounts & access them with a click. Visit http://www.inbox.com/notifier and check it out!

3 11

Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge
by jchase 23 Apr '15

23 Apr '15

Hello, When I run $ go get git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy $ sudo cp $GOPATH/bin/obfs4proxy /usr/local/bin on a laptop running linuxmint/ubuntu it produces a nice binary executable. Unfortunately it doesn't work to copy it to the Pi2, because it's not an ARM binary. When I run the same script on the Pi2 I get the following error messages: go get git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy # git.torproject.org/pluggable-transports/obfs4.git/common/ntor /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/common/ntor/ntor.go:272: undefined: sha256.Sum256 /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/common/ntor/ntor.go:369: undefined: hmac.Equal # git.torproject.org/pluggable-transports/obfs4.git/common/log /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/common/log/log.go:131: function ends without a return statement # git.torproject.org/pluggable-transports/obfs4.git/transports/obfs3 /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/transports/obfs3/obfs3.go:278: function ends without a return statement # git.torproject.org/pluggable-transports/obfs4.git/transports/scramblesuit /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/transports/scramblesuit/conn.go:322: undefined: hmac.Equal /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/transports/scramblesuit/handshake_uniformdh.go:143: undefined: hmac.Equal /usr/lib/go/src/pkg/git.torproject.org/pluggable-transports/obfs4.git/transports/scramblesuit/handshake_uniformdh.go:152: undefined: sha256.Sum256 and the script exits Any idea how I can get it cleanly on a Pi2? Thanks, J. Chase tor-relays-request(a)lists.torproject.org: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Re: Installing obfs4 on Raspberry Pi bridge (jchase) > 2. Re: Installing obfs4 on Raspberry Pi bridge (Yawning Angel) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 12 Apr 2015 17:43:55 +0000 > From: jchase <jchase(a)riseup.net> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge > Message-ID: <552AAEDB.4020007(a)riseup.net> > Content-Type: text/plain; charset=windows-1252 > > Hello, > Thanks to you I have tor 0.2.5.11 running on a Raspberry Pi2 and obfs4 > installed from git. I have good news and bad news. > The largest problem is that I get the warning "could not launch managed > proxy executable at '/path/obfs4proxy'('Permission denied')" In the past > this used to be a problem with apparmor, but apparmor isn't installed. > Any idea where I can start looking for a solution? > Here are a couple of details and small problems: > I didn't install obfs4 directly (due to problems), but installed it to > another laptop and copied it to the Pi2 using scp. > I have ORPort somewhere above 9000. When I set it to auto, I got a late > warning that the port chosen by tor was presenting problems, had I > arranged port forwarding, etc.? ExtORPort is "auto" and I get no > complaints (probably because obfs4 isn't working). > And I have ServerTransportListenAddr obfs3 0.0.0.0:90xx because a lower > port, like 80, with port forwarding, received a warning (and didn't work). > One thing at a time... Like I asked, where can I look for answers to the > obfs4proxy permission denied problem? If I get that fixed, I assume I > can play around with the rest until I can use lower ports. > Thanks, > J Chase > > > ------------------------------ > > Message: 2 > Date: Sun, 12 Apr 2015 20:14:33 +0000 > From: Yawning Angel <yawning(a)schwanenlied.me> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Installing obfs4 on Raspberry Pi bridge > Message-ID: <20150412201433.6c42f28d(a)schwanenlied.me> > Content-Type: text/plain; charset="us-ascii" > > On Sun, 12 Apr 2015 17:43:55 +0000 > jchase <jchase(a)riseup.net> wrote: >> Hello, >> Thanks to you I have tor 0.2.5.11 running on a Raspberry Pi2 and obfs4 >> installed from git. I have good news and bad news. >> The largest problem is that I get the warning "could not launch >> managed proxy executable at '/path/obfs4proxy'('Permission denied')" >> In the past this used to be a problem with apparmor, but apparmor >> isn't installed. Any idea where I can start looking for a solution? >> Here are a couple of details and small problems: >> I didn't install obfs4 directly (due to problems), but installed it to >> another laptop and copied it to the Pi2 using scp. > > Oh dear. What happens when you run the obfs4proxy executable in a > shell directly (on the pi2)? > > It should look something like: > $ ./obfs4proxy > 2015/04/12 20:13:02 [ERROR]: obfs4proxy - must be run as a managed > transport > > If not, what does 'file /path/obfs4proxy' say? > > Regards, >

2 1

Any t-shirts being sent?
by I 23 Apr '15

23 Apr '15

2 1

Delete keys on reboot
by CJ Barlow 23 Apr '15

23 Apr '15

The Tor Relay Security document suggests deleting keys upon reboot to prevent one-time key theft. I have tried to do this in Raspbian via cron but have been unsuccessful. The cronjob I have running is: @reboot rm -f /var/lib/tor/keys/* && echo "keys gone!" > /home/[me]/reboot.txt 2>&1 I have the echo as a debugger. When I changed /var/lib/tor/keys/* to /home/[me]/test/* the job runs successfully. When changing it back to /var/lib/tor/keys/* it does not. Is this something I should resolve? If so, is there something with my cronjob that's preventing it from working?

4 6

Re: [tor-relays] tor-relays Digest, Vol 51, Issue 27
by Rekha Tokas 23 Apr '15

23 Apr '15

Can I get the list of those sites which are blocking tor traffic to view or edit their page? On 23 Apr 2015 17:30, <tor-relays-request(a)lists.torproject.org> wrote: > Send tor-relays mailing list submissions to > tor-relays(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > or, via email, send a message with subject or body 'help' to > tor-relays-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-relays-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-relays digest..." > > > Today's Topics: > > 1. Re: Subpoena received (Jan GUTH) > 2. Re: Subpoena received (Jan GUTH) > 3. Re: Subpoena received (Brian Kroll) > 4. Re: Subpoena received (renke(a)mobtm.com) > 5. Re: Quantum Insert detection for everyone (tor(a)t-3.net) > 6. Re: Subpoena received (Moritz Bartl) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 23 Apr 2015 10:15:32 +0200 > From: Jan GUTH <prometheus(a)enn.lu> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Subpoena received > Message-ID: <5538AA24.3040802(a)enn.lu> > Content-Type: text/plain; charset=utf-8 > > On 20/04/15 16:32, Tyler Durden wrote: > > Hi > > I just wanted to let you know that Washington sent us a subpoena > > regarding one of our exit nodes in Romania. They want to know the real > > IP behind the Tor Network. I mailed them what Tor is and why I can't > > help them in identifying this person. Nevertheless I will give you the > > link to the full subpoena. Maybe you guys find it interesting. I will > > forward the subpoena to our lawyer as well. > > > > > > > https://mega.co.nz/#!ilIjlZSb!-deirKharWaDtp_UMxhev58E14zeouyoWUbzxeWPvEQ > > Good morning list, > > I just called up Alistar and explained the entire situation. They IT > guys know what Tor is and their company is strongly interested in > continuing supporting Tor. They are a partner company now of Voxility, > and the apparently while moving some clients, someone did forget to tell > them that they'll get a client running Tor exit nodes. > > They are simply overchallenged with this request as it is the very first > one they have ever received. > > The good news is, that they will _not_ shutdown our server, nor take any > logs, which are non-existant. The counterpart we need to contribute is a > letter by our lawyer and favorably a letter from EFF or some other > bigger organization guaranteeing Tor is what it is and we as client do > not try to fool them. > > This is a request from the administration level of the company, not the > tech guys - as always. > > So, I'll get in touch with our lawyer & with EFF. Is there anyone else > within EU, whom could certify them what Tor is and what it is capable of > and what not? Moritz? > > Cheers, > J. > > -- > Jan GUTH > International Coordinator > > Fr?nn vun der ?nn A.S.B.L. (NGO) > e. info(a)enn.lu (GPG: 0x02225522) > t. +352?691?71?77?44 > w. http://enn.lu/ > > > ------------------------------ > > Message: 2 > Date: Thu, 23 Apr 2015 10:20:10 +0200 > From: Jan GUTH <prometheus(a)enn.lu> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Subpoena received > Message-ID: <5538AB3A.2050701(a)enn.lu> > Content-Type: text/plain; charset=utf-8 > > On 20/04/15 16:32, Tyler Durden wrote: > > Hi > > I just wanted to let you know that Washington sent us a subpoena > > regarding one of our exit nodes in Romania. They want to know the real > > IP behind the Tor Network. I mailed them what Tor is and why I can't > > help them in identifying this person. Nevertheless I will give you the > > link to the full subpoena. Maybe you guys find it interesting. I will > > forward the subpoena to our lawyer as well. > > > > > > > https://mega.co.nz/#!ilIjlZSb!-deirKharWaDtp_UMxhev58E14zeouyoWUbzxeWPvEQ > > Good morning list, > > I just called up Alistar and explained the entire situation. They IT > guys know what Tor is and their company is strongly interested in > continuing supporting Tor. They are a partner company now of Voxility, > and the apparently while moving some clients, someone did forget to tell > them that they'll get a client running Tor exit nodes. > > They are simply overchallenged with this request as it is the very first > one they have ever received. > > The good news is, that they will _not_ shutdown our server, nor take any > logs, which are non-existant. The counterpart we need to contribute is a > letter by our lawyer and favorably a letter from EFF or some other > bigger organization guaranteeing Tor is what it is and we as client do > not try to fool them. > > This is a request from the administration level of the company, not the > tech guys - as always. > > So, I'll get in touch with our lawyer & with EFF. Is there anyone else > within EU, whom could certify them what Tor is and what it is capable of > and what not? Moritz? > > Cheers, > J. > > -- > Jan GUTH > International Coordinator > > Fr?nn vun der ?nn A.S.B.L. (NGO) > e. info(a)enn.lu (GPG: 0x02225522) > t. +352?691?71?77?44 > w. http://enn.lu/ > > > ------------------------------ > > Message: 3 > Date: Thu, 23 Apr 2015 08:29:45 +0000 > From: Brian Kroll <brian(a)fiberoverethernet.com> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Subpoena received > Message-ID: <5538AD79.3060902(a)fiberoverethernet.com> > Content-Type: text/plain; charset=windows-1252 > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA512 > > > Zack Weinberg: > > On Mon, Apr 20, 2015 at 10:32 AM, Tyler Durden <virii(a)enn.lu> > > wrote: > >> I just wanted to let you know that Washington sent us a subpoena > >> regarding one of our exit nodes in Romania > > > > Just FYI, "Washington" doesn't appear to have anything to do with > > this. The subpoena is on the letterhead of an office of Cook > > County, Illinois, which is the locality containing the city of > > Chicago. Per > > http://www.cookcountyil.gov/office-of-the-independent-inspector-general/ > > > > > this office investigates misconduct by county officials. > > > > This matters because, first, this is probably a tiny little outfit > > with little or no clue about either the Internet or international > > law. > > As a resident of Cook Country I can safely say it's not a small > locality, but I'm sure their knowledge about international law is > quite low. > > > They *should have* hired an international lawyer when they saw > > they'd need to talk to someone operating out of Romania and/or > > Luxembourg, but it doesn't surprise me in the slightest that they > > didn't. > > > And they've probably never even heard of Tor before. > > I know the Chicago Police claim they don't know what Tor is. > > http://www.muckrock.com/foi/chicago-169/chicago-police-use-of-tor-15392/ > > > Second, the incident which triggered the investigation, whatever it > > is, is probably quite minor. (This is backed up by their asking > > for one IP address active at a single point in time.) It would > > have been booted up to the state or federal level if it were any > > kind of serious. For both those reasons, I would rate the odds of > > them actually bothering to jump through all the necessary legal > > hoops to get a court order binding on a foreign national as slim to > > none. > > > ATB > //Brian > -----BEGIN PGP SIGNATURE----- > > iQIcBAEBCgAGBQJVOK1xAAoJEFjBjkteF9VaV2EP/3OrGZqHMdqWccR0Qkrt80rc > vw9RgIAtnhUfZVLlt8Y/RNhpSUOwrBf2gFxcc48zN3/Llad1ybF1PDFQym516ntK > RLRmGDf945qRxTsApXCN9WjRD0iMqyfQuq/NddTYKCMeMZadYW9MoUNe3md8wwKg > feeYNpCRmrTTh1Q7gRKYa4dRS6jLrNqNv5o/pL3jp5OlX8nLz+LyJxNVopZ2khAq > T4B51NOD0D5rLJ8cEQf528dmAM6QipUvtY3r5mVqb7VRO5NJuAxsRCnql6qTi68h > FIeLRZh44miY/vOS//dPlSFyb/h3ECVGCMH3ngtaJ5LLkAUXXWc8XYiEeDFyUrxg > O5/pUy9uo4ZRz9UXU7ZEpsttw2Gs1GDc7bRRrL4aHp8OGr+85p493aBqyixmr16d > Wz2lUdVioVBO5sj7rG+QXSc5b4Wp1/jKOWszKUNjX02AMnpe21idQrS0qn9kzSNP > Gsi8XyFP/08m+n2weTZ9W000uznjMCKWvWlOfJtTyo9oB23cZ7g/4Rs1j4wQR4W4 > 8/iuQFwjx3OipdxjzP4g3HwYLYeFT5DECVEzWtqx2LaIMI6ObTjDOnyO/PDIqzWA > YSK8hUqCKI6SqJE5l1kP4bzDsbQaY13nxoK0uVbW35h01FpHRIjyIXrFJorTqjrT > 8c3B2zNha+ogBOljvYtJ > =uUdm > -----END PGP SIGNATURE----- > > > ------------------------------ > > Message: 4 > Date: Thu, 23 Apr 2015 11:47:17 +0200 (CEST) > From: renke(a)mobtm.com > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Subpoena received > Message-ID: <20150423094717.382558A02B7(a)dd1818.kasserver.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi, > > > The counterpart we need to contribute is a > > letter by our lawyer and favorably a letter from EFF or some other > > bigger organization guaranteeing Tor is what it is and we as client do > > not try to fool them. > > as the US government sponsored (parts of) the Tor development - what about > giving them US military research papers about the Tor network? > > http://www.dtic.mil/dtic/tr/fulltext/u2/a465464.pdf is one of them, > co-authored by a Navy researcher and performed by the Naval Research > Laboratory. > > Not itself sufficient, but done by a bigger organisation w/o triggering > anarchist/commie/hacker/terroristsupporting/publicenemy bias reactions. > > Renke > > > ------------------------------ > > Message: 5 > Date: Thu, 23 Apr 2015 07:39:07 -0400 > From: tor(a)t-3.net > To: <tor-relays(a)lists.torproject.org> > Subject: Re: [tor-relays] Quantum Insert detection for everyone > Message-ID: <5538d9db.9d8.3c445700.6bd5299c(a)t-3.net> > Content-Type: text/plain; charset=us-ascii; format=flowed > > > On 04/23/2015 01:56 AM, David Stainton wrote: > > > It is possible to add a "prevention" mechanism to HoneyBadger; an > > event based firewall ruleset generator made to block TCP injection > > attacks as they are happening... yes. This is possible. I could > write > > that if there was interest from enough people. > > Gief. > > > > > > ------------------------------ > > Message: 6 > Date: Thu, 23 Apr 2015 13:57:32 +0200 > From: Moritz Bartl <moritz(a)torservers.net> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Subpoena received > Message-ID: <5538DE2C.3030200(a)torservers.net> > Content-Type: text/plain; charset=utf-8 > > On 04/23/2015 10:20 AM, Jan GUTH wrote: > > So, I'll get in touch with our lawyer & with EFF. Is there anyone else > > within EU, whom could certify them what Tor is and what it is capable of > > and what not? Moritz? > > Depends on what convinces them. :-) Sounds like it may make sense to get > a generic letter signed by all our partner organizations (which includes > Reporters without Borders, Institute of War & Peace Reporting, > Article19, and potentially other Human Rights Orgs) in the long run. > > I'm happy to write something as Torservers.net, in a way representing > all the current partner orgs. Then, we can send the letter around and > get it co-signed by all the partner orgs and other orgs. > > -- > Moritz Bartl > https://www.torservers.net/ > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > ------------------------------ > > End of tor-relays Digest, Vol 51, Issue 27 > ****************************************** >

1 0

Re: [tor-relays] Quantum Insert detection for everyone
by tor＠t-3.net 23 Apr '15

23 Apr '15

On 04/23/2015 01:56 AM, David Stainton wrote: > It is possible to add a "prevention" mechanism to HoneyBadger; an > event based firewall ruleset generator made to block TCP injection > attacks as they are happening... yes. This is possible. I could write > that if there was interest from enough people. Gief.

1 0

Quantum Insert detection for everyone
by David Stainton 22 Apr '15

22 Apr '15

Greetings, Did you all see this Wired article about Quantum Insert detection? https://www.wired.com/2015/04/researchers-uncover-method-detect-nsa-quantum… These TCP injection attacks are used by various entities around the world (not just NSA!) to target individuals for surveillance or perhaps to add their computers to a botnet for other purposes. If you do not use a VPN or Tor you can run "Quantum Insert" detection on your computer and detect when you receive an attack attempt. However be advised that proper sandboxing is important here because intrusion detection and protocol anylsis tools are notoriously insecure and get pwned all the time. If you are a Tor exit relay operator you have the options of running detection software; However you should not publish the results publicly without mixing in some noise or your published data might make it possible for some adversaries to deanonymize Tor users. If your country has strict telecommunications laws then it might only be legal for you to perform this type of detection if you do not perform logging. For the past several months... in my free time I've been slowly developing a very comprehensive TCP injection attack detection tool called HoneyBadger: https://github.com/david415/HoneyBadger Quantum Insert is a NSA codeword for "TCP injection attack", however either of these terms are too vague. During my research I was able to classify 4 different types of TCP injection attack. When I say that HoneytBadger is comprehensive what I mean is that Honeybadger can detect ALL of these types of TCP injection attack types... I describe them briefly here: https://honeybadger.readthedocs.org/en/latest/ Here's the Fox-IT blog post about their Quantum Insert detection software: http://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/ I am going to work on writing a much more comprehensive blog post; it will be filled with gory technical details AND it will include information on how to use HoneyBadger. HoneyBadger has optional (off by default) full-take logging which could enable you to capture a zero-day payload from a TCP attack; you should then responsibly disclose to the software vendor or contact a malware analyst to help out! Sincerely, David Stainton

2 4

ARM stopped working
by Jeffrey Hathaway 22 Apr '15

22 Apr '15

Hello Everyone, I noticed ARM stopped working for me. Has anyone seen this before? Traceback (most recent call last): File "/usr/share/arm/starter.py", line 578, in <module> cli.controller.startTorMonitor(time.time() - initTime) File "/usr/share/arm/cli/controller.py", line 700, in startTorMonitor curses.wrapper(drawTorMonitor, startTime) File "/usr/lib/python2.7/curses/wrapper.py", line 43, in wrapper return func(stdscr, *args, **kwds) File "/usr/share/arm/cli/controller.py", line 720, in drawTorMonitor initController(stdscr, startTime) File "/usr/share/arm/cli/controller.py", line 86, in initController firstPagePanels.append(cli.logPanel.LogPanel(stdscr, expandedEvents, config)) File "/usr/share/arm/cli/logPanel.py", line 652, in __init__ self.reprepopulateEvents() File "/usr/share/arm/cli/logPanel.py", line 696, in reprepopulateEvents torEventBacklog = getLogFileEntries(setRunlevels, readLimit, addLimit, self._config) File "/usr/share/arm/cli/logPanel.py", line 313, in getLogFileEntries eventTimeComp = list(time.strptime(timestamp, "%Y %b %d %H:%M:%S")) File "/usr/lib/python2.7/_strptime.py", line 467, in _strptime_time return _strptime(data_string, format)[0] File "/usr/lib/python2.7/_strptime.py", line 325, in _strptime (data_string, format)) ValueError: time data '2012 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00Apr 22 15:23:48' does not match format '%Y %b %d %H:%M:%S'

3 2