- tor-relays - lists.torproject.org

tor_bug_occured_(): This line should not have been reached
by [REDACTED] 09 Jul '19

09 Jul '19

Hey guys, my relay 79E683340B80676DCEB029E48FBD36BC66EBDA1E told me: Jul 06 15:22:34.000 [notice] DoS mitigation since startup: 0 circuits killed with too many cells. 150515 circuits rejected, 16 marked addresses. 0 connections closed. 104 single hop clients refused. Jul 06 16:23:25.000 [warn] tor_bug_occurred_(): Bug: ../src/core/or/channeltls.c:1111: channel_tls_handle_cell: This line should not have been reached. (Future instances of this warning will be silenced.) (on Tor 0.3.5.8 ) Jul 06 16:23:25.000 [warn] Bug: Line unexpectedly reached at channel_tls_handle_cell at ../src/core/or/channeltls.c:1111. Stack trace: (on Tor 0.3.5.8 ) Jul 06 16:23:25.000 [warn] Bug: /usr/bin/tor(log_backtrace_impl+0x46) [0x562903c4faa6] (on Tor 0.3.5.8 ) Jul 06 16:23:25.000 [warn] Bug: /usr/bin/tor(tor_bug_occurred_+0xc0) [0x562903c4b1c0] (on Tor 0.3.5.8 ) Jul 06 16:23:25.000 [warn] Bug: /usr/bin/tor(channel_tls_handle_cell+0x49a) [0x562903ad571a] (on Tor 0.3.5.8 ) Jul 06 16:23:25.000 [warn] Bug: /usr/bin/tor(+0x9a16a) [0x562903af916a] (on Tor 0.3.5.8 ) Jul 06 16:23:25.000 [warn] Bug: /usr/bin/tor(connection_handle_read+0x99d) [0x562903ac318d] (on Tor 0.3.5.8 ) Jul 06 16:23:25.000 [warn] Bug: /usr/bin/tor(+0x69ebe) [0x562903ac8ebe] (on Tor 0.3.5.8 ) Jul 06 16:23:25.000 [warn] Bug: /usr/lib/x86_64-linux-gnu/libevent-2.1.so.6(+0x229ba) [0x7f469cdbf9ba] (on Tor 0.3.5.8 ) Jul 06 16:23:25.000 [warn] Bug: /usr/lib/x86_64-linux-gnu/libevent-2.1.so.6(event_base_loop+0x5a7) [0x7f469cdc0537] (on Tor 0.3.5.8 ) Jul 06 16:23:25.000 [warn] Bug: /usr/bin/tor(do_main_loop+0xb0) [0x562903aca290] (on Tor 0.3.5.8 ) Jul 06 16:23:25.000 [warn] Bug: /usr/bin/tor(tor_run_main+0x10e5) [0x562903ab80d5] (on Tor 0.3.5.8 ) Jul 06 16:23:25.000 [warn] Bug: /usr/bin/tor(tor_main+0x3a) [0x562903ab530a] (on Tor 0.3.5.8 ) Jul 06 16:23:25.000 [warn] Bug: /usr/bin/tor(main+0x19) [0x562903ab4ec9] (on Tor 0.3.5.8 ) Jul 06 16:23:25.000 [warn] Bug: /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x7f469c6a109b] (on Tor 0.3.5.8 ) Jul 06 16:23:25.000 [warn] Bug: /usr/bin/tor(_start+0x2a) [0x562903ab4f1a] (on Tor 0.3.5.8 ) Jul 06 21:22:34.000 [notice] Heartbeat: Tor's uptime is 12 days 6:00 hours, with 5113 circuits open. I've sent 2802.42 GB and received 2781.10 GB. Jul 06 21:22:34.000 [notice] Circuit handshake stats since last time: 13801/13801 TAP, 169020/169020 NTor. Its anyway a little bit strange because this is the only relay i have which never deleted his logfiles since i set it up and where i can not change the language of the operating system. I think its related to the host system but i never really thought about because it seems to work fine. Something i should do now?

2 1

Re: [tor-relays] Call for setting up new obfs4 bridges
by nottryingtobelame＠protonmail.com 09 Jul '19

09 Jul '19

Hello, I successfully ran an obfs4 bridge about a year ago that saw moderate traffic. After a few months, the traffic died off until I was consistently seeing 0 clients. I wiped the keys, got a new IP address, and started a new bridge. The 2nd bridge saw 0 clients, over several months. I finally wiped it again and started a 3rd bridge. Same thing, 0 clients for several months. My 4th bridge, which I took down last night, was up for just shy of 3 months with 0 clients. Before I took it down, I tested using https://bridges.torproject.org/scan/ and confirmed the ports were reachable. While I was not able to test the previous iterations, I setup the port forwarding for each of them for both the OR Port and the Ext OR Port that it randomly assigned. I won't be able to grab a new IP address this time, but I'm starting the bridge up again with new ID keys and new ports. Is it normal for bridges to see no traffic, and if they're not seeing any, should I keep them online?

2 1

Testing the accessibility of my obfs4 bridge
by nottryingtobelame＠protonmail.com 09 Jul '19

09 Jul '19

I plugged my bridgeline into Tor Browser on Windows, and connected successfully. I put it into Orbot on Android and also connected successfully. But when I put it into the new Tor Browser for Android, I am unable to connect. The logs from Tor Browser are pasted here: https://pastebin.com/cF5bwRH1. Any idea why one client would be failing to connect? Thanks in advance.

2 1

ExoneraTor results may be incomplete between April 25 and 30, 2019 and during other periods
by Karsten Loesing 08 Jul '19

08 Jul '19

Hello relay operators, it turns out that our exit scanner had an issue between April 25 and 29, 2019 and that ExoneraTor results may be incomplete during this time. Some context, taken from the ExoneraTor page: https://metrics.torproject.org/exonerator.html "The ExoneraTor service maintains a database of IP addresses that have been part of the Tor network. It answers the question whether there was a Tor relay running on a given IP address on a given date. ExoneraTor may store more than one IP address per relay if relays use a different IP address for exiting to the Internet than for registering in the Tor network, and it stores whether a relay permitted transit of Tor traffic to the open Internet at that time." Now, if somebody looks up their exit IP address during the time between April 25 and 29, 2019, their relay won't be listed in the results. It will still be included with the IP address that it used for registering at the directory authorities, but not with its exit IP address. I looked through the archive of exit lists and found similar downtimes of 18 hours or longer which would have the same effect: Gap of 19 hours between 2011-09-10T00:05:00 and 2011-09-10T19:28:46. Gap of 23 hours between 2011-12-21T01:21:19 and 2011-12-22T00:23:36. Gap of 111 hours between 2012-02-07T02:33:16 and 2012-02-11T18:07:47. Gap of 26 hours between 2013-03-07T15:16:50 and 2013-03-08T17:17:55. Gap of 156 hours between 2013-03-14T09:29:25 and 2013-03-20T22:03:41. Gap of 19 hours between 2015-10-09T14:13:37 and 2015-10-10T09:57:26. Gap of 18 hours between 2018-02-02T18:27:54 and 2018-02-03T13:06:09. Gap of 122 hours between 2019-04-25T13:13:19 and 2019-04-30T15:40:21. Gap of 21 hours between 2019-05-25T19:04:43 and 2019-05-26T16:09:23. We're working on adding a notice to ExoneraTor results in case a lookup falls into one of these periods, but that will take us some time. https://trac.torproject.org/projects/tor/ticket/31071 Sorry for any confusions caused by this! All the best, Karsten

1 0

obfs4 relay lost stable flag
by tor 01 Jul '19

01 Jul '19

Hi I've been running an obfs4 bridge for about a month. My hashed fingerprint is: E120A0492F789F5367EAD84C64F92EE279018F98 I recently lost the stable flag. Not sure why. Any thoughts? thanks matt

3 2

Tor Performance on Xen vs KVM
by Conrad Rockenhaus 30 Jun '19

30 Jun '19

Hello, I’m just curious on how people feel about relay performance on Tor nodes running on Xen vs KVM. I’ve noticed on Xen I have increased network performance and I do like the improved modular architecture of Xen vs KVM (right now I’m working on an experimental OpenStack w/ XCP-ng environment). I was wondering if any others on the list had experience running high performance Tor nodes on Xen and KVM and have a preference for one over the other… I’m just trying to compare and contrast here. Of course, I built a XCP-ng pool with a compute VM, then I have a regular KVM compute instance running under the Openstack framework. Thanks, Conrad Rockenhaus http://www.greyponyit.com/

1 0

BridgeDB currently up but non-functional?
by Rick Huebner 29 Jun '19

29 Jun '19

Hi, all. While skimming /r/tor on Reddit I saw a couple of posts saying they hadn't been able to get any usable bridges for several days, and thought I'd check into it. I downloaded & installed a fresh copy of the Windows TBB 8.5.1 and had it ask for bridges via Moat, and received 2 (not 3?) obfs4 bridge lines. Here's the Tor log from the "copy to clipboard" button that popped up on the TBB "connecting" dialog when it stalled at about 3/4th of the progress bar: 6/19/19, 10:46:16.735 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 6/19/19, 10:46:16.735 [NOTICE] Switching to guard context "bridges" (was using "default") 6/19/19, 10:46:16.735 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 6/19/19, 10:46:16.736 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 6/19/19, 10:46:16.736 [NOTICE] Opening Socks listener on 127.0.0.1:9150 6/19/19, 10:46:16.736 [NOTICE] Opened Socks listener on 127.0.0.1:9150 6/19/19, 10:46:16.736 [NOTICE] Renaming old configuration file to "C:\Downloads\Tor Browser 8.5.1 - Copy\Browser\TorBrowser\Data\Tor\torrc.orig.1" 6/19/19, 10:46:23.608 [NOTICE] Bootstrapped 5%: Connecting to directory server 6/19/19, 10:46:23.611 [NOTICE] Bootstrapped 10%: Finishing handshake with directory server 6/19/19, 10:46:24.558 [NOTICE] Bootstrapped 15%: Establishing an encrypted directory connection 6/19/19, 10:46:24.748 [NOTICE] Bootstrapped 20%: Asking for networkstatus consensus 6/19/19, 10:46:24.954 [NOTICE] new bridge descriptor 'eldritchworld' (fresh): $<BRIDGE 1 FINGERPRINT REDACTED>~eldritchworld at <BRIDGE 1 IP REDACTED> 6/19/19, 10:46:25.589 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:26.781 [NOTICE] Bootstrapped 25%: Loading networkstatus consensus 6/19/19, 10:46:28.291 [NOTICE] I learned some more directory information, but not enough to build a circuit: We have no usable consensus. 6/19/19, 10:46:28.482 [NOTICE] Bootstrapped 40%: Loading authority key certs 6/19/19, 10:46:28.997 [NOTICE] The current consensus has no exit nodes. Tor can only build internal paths, such as paths to onion services. 6/19/19, 10:46:28.997 [NOTICE] Bootstrapped 45%: Asking for relay descriptors for internal paths 6/19/19, 10:46:28.997 [NOTICE] I learned some more directory information, but not enough to build a circuit: We need more microdescriptors: we have 0/6440, and can only build 0% of likely paths. (We have 100% of guards bw, 0% of midpoint bw, and 0% of end bw (no exits in consensus, using mid) = 0% of path bw.) 6/19/19, 10:46:28.997 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:28.997 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:28.997 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:28.997 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:28.997 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:28.997 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:29.275 [NOTICE] Bootstrapped 50%: Loading relay descriptors for internal paths 6/19/19, 10:46:29.463 [NOTICE] The current consensus contains exit nodes. Tor can build exit and internal paths. 6/19/19, 10:46:29.463 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:29.463 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:29.463 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:29.514 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:29.514 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:29.672 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:29.672 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:29.672 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.283 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.283 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.283 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.636 [NOTICE] Bootstrapped 57%: Loading relay descriptors 6/19/19, 10:46:30.636 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.636 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.636 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.636 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.636 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.684 [NOTICE] Bootstrapped 64%: Loading relay descriptors 6/19/19, 10:46:30.684 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.733 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.733 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.733 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.873 [NOTICE] Bootstrapped 73%: Loading relay descriptors 6/19/19, 10:46:30.873 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.873 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.881 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.881 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.881 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.937 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:30.969 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 6/19/19, 10:46:44.618 [WARN] Proxy Client: unable to connect to <BRIDGE 2 IP REDACTED> ("general SOCKS server failure") It looks like bridge 1 (eldritchworld) gave me bad/incomplete relay info which prevented making circuits, and then Tor failed to connect to the fallback bridge 2 at all. Checking Relay Search, it shows that eldritchworld is a normal healthy-looking bridge that's been up for months with plenty of connections and data being transferred, so I don't know what's wrong there. So, since the Moat bridges didn't work, I went to the BridgeDB request web page to try that. Clicking the "Just give me bridges" button and doing the captcha returned "Uh oh, spaghettios! There currently aren't any bridges available... Perhaps you should try going back and choosing a different bridge type!". What, no vanilla bridges available at all? Seriously? (As a side note, cutesy errors are pretty annoying when things are failing. Just sayin'.) And as usual the Metrics page still shows about 1000 bridges, so something's badly broken. I know the new bridgedb release doesn't give out ORports if there's a secure PT offered, but last I checked the majority of bridges were just vanilla, so surely there must be enough to put some into whichever bridge pool ring my request was pulled from. I then tried asking for obfs4 bridges instead, and it did give me one (again, not 3?). With another fresh install of the TBB and entering that bridge line, the log shows: 6/19/19, 10:59:43.912 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 6/19/19, 10:59:43.912 [NOTICE] Switching to guard context "bridges" (was using "default") 6/19/19, 10:59:43.912 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 6/19/19, 10:59:43.912 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 6/19/19, 10:59:43.912 [NOTICE] Opening Socks listener on 127.0.0.1:9150 6/19/19, 10:59:43.912 [NOTICE] Opened Socks listener on 127.0.0.1:9150 6/19/19, 10:59:43.912 [NOTICE] Renaming old configuration file to "C:\Downloads\Tor Browser 8.5.1 - Copy\Browser\TorBrowser\Data\Tor\torrc.orig.1" 6/19/19, 10:59:50.761 [NOTICE] Bootstrapped 5%: Connecting to directory server 6/19/19, 10:59:50.762 [NOTICE] Bootstrapped 10%: Finishing handshake with directory server 6/19/19, 11:00:11.767 [WARN] Proxy Client: unable to connect to <BRIDGE 3 IP> ("general SOCKS server failure") So this 3rd bridge also failed to connect at all. With the Moat and website requests both returning bad/dead bridges (if any), the last thing to try was the email request channel. I sent "request bridges" to bridges(a)torproject.org and it replied back "Here are your bridges: None, None, None". Well, okay then. Maybe if I try again later, which should give me different bridges to use? According to the bridgedb config file checked into the git repo, the rotation periods for the Moat and website bridge pool query positions are both 3 hours. So I waited 3.5 hours and tried those tests again on another fresh TBB install copy, and both Moat and the website returned back to me the exact same bridges as before, which then failed in the same ways as before. Maybe the running server isn't using the checked-in config settings? Waiting another 8 hours (11.5 total since the first try), Moat gave me the same first bridge but finally a different second bridge (still not 3), but that one also failed to connect at all with the same "general SOCKS server failure". The website still claims there are no vanilla bridges available at all, and gives me back the same single obfs4 choice as before, which still won't connect at all. I don't know if it's the link between the bridge authority and the bridgdb server, or the new bridgedb release that just came out or what, but something's badly broken and the bridgedb appears to be pretty much useless right now. My test environment is very standard, just Windows 10 Pro using only IPV4 from a normal US ISP (Frontier FIOS near Portland, OR) with no proxy, running a fresh copy of the current TBB build. The TBB works fine if I don't use a bridge or if I manually enter the bridge info for a private bridge relay I temporarily set up, and I have no other internet issues. Could someone else check if they see similar problems? Other people should supposedly get different bridgedb results pulled from the other bridge pool rings, but even if it's somehow only affecting one pool ring, that's like 20-25% of the bridgedb's users left with no viable results. Looking at the Metrics site I don't see any drop in current bridge user counts (actually it's in an uptrend, along with all tor user counts lately) but I'd assume most bridge users already have working bridge lines cached, so this would only affect new users or those whose old choices have gone down, but both of those categories will only grow with time.

2 5

An easy self-DoS and how to avoid it
by j4c4l4 28 Jun '19

28 Jun '19

Hi there, I have been operating a non-exit relay and a bridge for about one week now. I discovered by chance a quite silly self-DoS which could be triggered by using a NIDS (Network Intrusion Detection System) on relays. I don't know if it is known, but I thought it was worth reporting it here. In many Linux distributions, several NIDSs come with a default policy that blocks all the traffic from offending IPs after they have reached a threshold score. The offending IPs are normally put into a separate firewall chain/table that DROPs all the traffic originating from them, and then re-enabled after a period that could vary between 30 minutes and a few hours (again, depending on the config). Now, this could be potentially used to periodically shut down relays. In fact, an attacker could perform something as simple as an ssh login scan *through tor*, which is among the "attacks" monitored by most of the NIDS out there. But since the login attempts appear to originate from the tor exit relay, this effectively flags *the exit* as an "offending" host, and triggers the corresponding firewall rule (which is normally a blind "DROP", to save on rule processing). Once an exit node is flagged as "offending" and put in the firewall rule, any traffic between the relay and the exit node is effectively forbidden, until the firewall rule is removed or the tables flushed. If performed on a large scale, this can potentially shut down all the relays which run a NIDS with such policy on ssh logins. The same is true for other simulated attacks on other protocols (but ssh monitoring and blind DROPs are so much common to be the ones of most concern, maybe). I don't know how many relays run a NIDS (I suspect several do, actually), but it would be better to be aware of this potential self-DoS attack. The easy solution (apart from not using any IDS on relays) is to make sure that all the incoming traffic to the ORPort is always accepted, e.g. introducing an ad-hoc firewall first rule that accepts all TCP stuff from the ORPort, before processing NIDS-managed rules. Sorry if this was known already, but I couldn't find anything related by looking at the recent topics in the ML archives, and I thought it coud be useful to share. Regards

1 0

Best practice for tor-exit node when I switch internet providers?
by Chris Dagdigian 28 Jun '19

28 Jun '19

Hello, I've been running a tor exit node in the US since 2014 when I paid way too much for a comcast business internet circuit that came with static IPs and a TOS that allowed me to run servers at home. It looks like I'm going to switch providers in a month or so as there is a fiber service I can get with symmetric bandwidth, the static IP count I want and theoretically also a TOS that is also amenable to server hosting. What is the best practice if I want to keep my tor exit going but switch upstream carriers and IP addresses? I'm guessing this is going to trip a bunch of tor monitoring alerts if I just bring the server up at a new IP address. Should I change the nickname? Totally wipe and reinstall tor itself? The goal is to bring back the same exit node but not set off any alarms when the exit node with the same IP for many years suddenly shows up with a new address. -Chris

2 1

torrelays have no bandwith
by TorGate 28 Jun '19

28 Jun '19

Hi to all, i have issues with my 3 relays, there is no bandwith ?! i have not changed the config only updatet the tor software. In nyx can i see there are smal bandwith connections 1-100 kbs. All 3 relays have a 5mbit up/down connection. https://metrics.torproject.org/rs.html#search/torgate

3 3

Interesting Reddit Post for Tor Relay Operators on Verizon FiOS (Verizon blocks Verizon.com on Tor Relay IP Addresses Including Non-Exit Relays)
by neel＠neelc.org 27 Jun '19

27 Jun '19

Hi tor-relays@ mailing list, If you are running Tor relays on FiOS, or run Tor relays and are considering joining FiOS, here's an interesting Reddit Post: Title: Verizon blocks Verizon.com on Tor Relay IP Addresses (Including Non-Exit Relays) URL: https://www.reddit.com/r/privacy/comments/c5whh5/verizon_blocks_verizoncom_… -Neel Chauhan === https://www.neelc.org/

1 0

TCP SACK PANIC type kernel vulnerabilities: logging some packets
by tor＠t-3.net 26 Jun '19

26 Jun '19

As of last week there wasn't a new kernel out for our relay's distro, so I implemented an IPTables-based mitigation in our relay as such: -A INPUT -p tcp --tcp-flags SYN SYN -m tcpmss --mss 1:500 -j LOG --log-prefix "TCP_SACK_PANIC: " -A INPUT -p tcp --tcp-flags SYN SYN -m tcpmss --mss 1:500 -j DROP Over the weekend we logged hits to this rule. I checked a few of the source hosts, and they were not relays at least as they are listed in https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1.1.1.1 . I'll pull the rule out once the kernel is patched, but yeah. Things that make you go hmm.

2 1

Re: [tor-relays] Tor memory leak (0.3.5.7)?
by starlight.2018q2＠binnacle.cx 25 Jun '19

25 Jun '19

Hi, No leaks. The VM has 1GB, very light for moderate busy relay. Should be 4GB, perhaps 3DB would do. Settings should include: AvoidDiskWrites 1 DisableAllSwap 1 MaxMemInQueues 1024MB # perhaps 1536MB My relays run about 800MB to 1.2GB. A nice way to view memory usage is with egrep '^Vm' /proc/$(cat /var/run/tor.pid)/status which might show something like VmPeak: 871696 kB VmSize: 710152 kB VmLck: 710148 kB VmHWM: 810872 kB VmRSS: 649328 kB VmData: 492052 kB VmStk: 93 kB VmExe: 4704 kB VmLib: 104724 kB VmPTE: 1044 kB Notice that current VmSize usage is less than VmPeak, indicating that memory was release by glibc malloc. Tor consumes substantial skbuf memory in the kernel, which accounts for some of the difference in reported size for VmRSS and VmSize and total memory consumption.

3 2

Build problem
by dns1983＠riseup.net 25 Jun '19

25 Jun '19

Hello, I'm trying to build tor for from source on a x86 Debian stretch machine. I first installed all dependencies, but when I launch the "./configure" command I see the following error: configure: WARNING: Unable to find liblzma. configure: WARNING: Unable to find libzstd I installed, among the others liblzma-dev, lzma, libzstd-dev and zstd. I'm working through ssh. What I'm doing wrong? Could It be caused by a wrong environment variables settings? Cheers Gigi

2 2

obfs4proxy installation from deb.torproject.org says Release file expired
by s7r 25 Jun '19

25 Jun '19

Hello, Trying to spin some new obfs4bridges. I am using: deb.torproject.org/torproject.org obfs4proxy main in /etc/apt/sources.list -- I hope this is correct. I get this: E: Release file for https://deb.torproject.org/torproject.org/dists/obfs4proxy/InRelease is expired (invalid since 1d 15h 7min 11s). Updates for this repository will not be applied. Just recently saw Yawning's release notification, is it somehow related? Thanks.

2 1

fresh assault on Tor network
by starlight.2018q2＠binnacle.cx 25 Jun '19

25 Jun '19

https://metrics.torproject.org/userstats-relay-country.html?start=2017-06-2…

3 3

Become a Fallback Directory Mirror
by gus 25 Jun '19

25 Jun '19

Dear Relay Operators, Do you want your relay to be a Tor fallback directory mirror? Will it have the same address and port for the next 2 years? Just reply to this email with your relay's fingerprint. If your relay is on the current list, you don't need to do anything. If you're asking: Q: What's a fallback directory mirror? Fallback directory mirrors help Tor clients connect to the network. For more details, see [1]. Q: Is my relay on the current list? Search [2] and [3] for your relay fingerprint or IP address and port. [2] is the current list of fallbacks in Tor. [3] is used to create the next list of fallbacks. Q: What do I need to do if my relay is on the list? Keep the same IP address, keys, and ports. Email tor-relays if the relay's details change. Q: Can my relay be on the list next time? We need fast relays that will be on the same IP address and port for 2 years. Reply to this email to get on the list, or to update the details of your relay. Once or twice a year, we run a script to choose about 150-200 relays from the potential list [3] for the list in Tor [2]. Q: Why didn't my relay get on the list last time? We check a relay's uptime, flags, and speed [4]. Sometimes, a relay might be down when we check. That's ok, we will check it again next time. It's good to have some new relays on the list every release. That helps tor clients, because blocking a changing list is harder. cheers, gus [1] https://trac.torproject.org/projects/tor/wiki/doc/FallbackDirectoryMirrors [2] https://gitweb.torproject.org/tor.git/tree/src/or/fallback_dirs.inc [3] https://gitweb.torproject.org/tor.git/tree/scripts/maint/fallback.whitelist [4] https://trac.torproject.org/projects/tor/attachment/ticket/21564/fallbacks_…

13 19

Re: [tor-relays] Become a Fallback Directory Mirror
by teor 24 Jun '19

24 Jun '19

Hi, > On 24 Jun 2019, at 02:49, tschador(a)posteo.de wrote: > > On 2019-06-23 14:32, teor wrote: > >> But your relay needs a DirPort to be a fallback directory mirror. >> Here are some instructions for different platforms: >> https://trac.torproject.org/projects/tor/wiki/TorRelayGuide#Platformspecifi… > > This should be clarified in the Tor manual [1] too! > > "Tor will contact the authority at ipv4address to download directory > documents. The provided port value is a dirport; clients ignore this in > favor of the specified "orport=" value. If an IPv6 ORPort is supplied, > Tor will also download directory documents at the IPv6 ORPort." > > Am I right that for fallback directory mirrors DirPort is needed but > ignored by clients? It is needed to make sure that the relay serves directory documents. We run a script that uses the DirPort to check the download speed. > Possibly this explains why I lost the fallback > directory flag since I have removed the DirPort in torrc … Fallbacks need the same ports, IP addresses, and keys for 2 years. That includes the DirPort. It's not possible to configure a fallback without a dirport: FallbackDir ipv4address:port orport=port id=fingerprint [weight=num] [ipv6=[ipv6address]:orport] (The first port is a dirport, and both dirport and orport are required.) I have updated the template: https://trac.torproject.org/projects/tor/wiki/doc/UpdatingFallbackDirectory… And opened a ticket for the man page: https://trac.torproject.org/projects/tor/ticket/30955 T

1 0

Tor memory leak (0.3.5.7)?
by Roman Mamedov 24 Jun '19

24 Jun '19

Hello, As sometimes happens, I notice my nodes getting into swap heavily. This time: ------------ KiB Mem: 1010576 total, 897388 used, 113188 free, 5144 buffers KiB Swap: 1048572 total, 123592 used, 924980 free. 61732 cached Mem PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 4740 debian-+ 25 5 565448 259032 15204 R 63.2 25.6 1621:47 tor 4765 debian-+ 25 5 491636 200812 13136 S 32.9 19.9 678:36.65 tor total used free shared buffers cached Mem: 1010576 870392 140184 4 1144 64604 -/+ buffers/cache: 804644 205932 Swap: 1048572 123592 924980 ------------ After killing PID 4740 and starting that instance again (now PID 25456): ------------ KiB Mem: 1010576 total, 691264 used, 319312 free, 4336 buffers KiB Swap: 1048572 total, 58624 used, 989948 free. 209692 cached Mem Unknown command - try 'h' for help PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 4765 debian-+ 25 5 491636 195900 8584 R 38.3 19.4 678:56.29 tor 25456 debian-+ 20 0 441092 240824 140452 S 29.9 23.8 0:28.48 tor total used free shared buffers cached Mem: 1010576 663816 346760 12 4344 209692 -/+ buffers/cache: 449780 560796 Swap: 1048572 58624 989948 ------------ How come killing a Tor instance which was shown to be using 259 MB of RAM, has freed up 355 MB, even counting the new copy of Tor which was started in its place and is already using 240 MB? The math only adds up to 19 MB delta, not 355. As this memory usage doesn't seem to be attributed to Tor, it reminds me of that major memory leak which was fixed some time ago, so maybe it was not fixed entirely? -- With respect, Roman

1 0

Re: [tor-relays] tor update question
by Olaf Grimm 21 Jun '19

21 Jun '19

On Website: "update to latest upstream release (bz#1679732) How to install sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-EPEL-2019-f8311ec8a2" Not working! The command there is "dnf". A replacement with "yum" get the following error on my system: "[root@75f449 ~]# yum upgrade --enablerepo=updates-testing --advisory=FEDORA-EPEL-2019-f8311ec8a2 Geladene Plugins: fastestmirror Error getting repository data for updates-testing, repository not found [root@75f449 ~]# " Any other solution available? Olaf Am 20.06.19 um 21:31 schrieb nusenu: >> I am running Centos7 (CentOS Linux release 7.6.1810 (Core)) and Tor >> v. 0.3.5.7. Now I see in nyx that is is unrecommended, but the epel >> repo doesn't have 0.3.5.8. Should I be adding another repo, or just >> wait, or try to compile my own? > You can get tor 0.3.5.8 on CentOS 7 by enabling the updates-testing repo > > https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-f8311ec8a2 > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

tor update question
by torix＠protonmail.com 21 Jun '19

21 Jun '19

Dear List, I am running Centos7 (CentOS Linux release 7.6.1810 (Core)) and Tor v. 0.3.5.7. Now I see in nyx that is is unrecommended, but the epel repo doesn't have 0.3.5.8. Should I be adding another repo, or just wait, or try to compile my own? TIA, --Torix Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Wrong country and AS number/ name
by ILikeTor 20 Jun '19

20 Jun '19

Hello everybody, I have set up a relay about 3 days ago now. I am hosting my relay at a German hosting provider called "contabo", but the relay search of Tor Metrics tells me that the relay is based in the United States and that the AS number and name are unknown. Does someone know what I could do to fix this? Link: https://metrics.torproject.org/rs.html#details/53E89AD9B9320749F04DCA757F1C… Thanks in advance :) ILikeTor (or so - I definitely need a better nickname :/)

3 2

Tor Debian repo update
by Peter Ludikovsky 20 Jun '19

20 Jun '19

Hello, Does the official Tor Project repo provide upgrades to the new 0.4.0.5 stable for anyone? I can see the new packages in pool/main/t/tor/, but the package index in dists/stretch/main/binary-amd64/Packages still points to 0.3.5.8. Regards, /peter

3 2

Moving Exit Node
by Yggdrasil Admin 20 Jun '19

20 Jun '19

Hi at all. Yesterday i was kicked by my hosting provider urdn (https://urdn.com.ua) kicked me because "someone we can't name here, wasn't happy" about what i did on a non urdn server. That's why they nullrouted my ipv4 and made the Exit Node inaccessible. After a talk with the support over jabber he told my that the server was still accessible over ipv6 so i backuped my identity keys and tried to setup my exit node on another server which wasn't possible because it alway tried to connect to the nullrouted ipv4. My main question is: Can i setup my exit node on another server with another ipv4 or is this impossible? Regards

2 1

Re: [tor-relays] Questions about relays on IPv6
by teor 19 Jun '19

19 Jun '19

Hi, > On 19 Jun 2019, at 05:56, tschador(a)posteo.de wrote: > > I have enabled IPv6 on my Relay [1] and setup a new one [2]. > Both got the additional Flag 'ReachableIPv6' - fine. > > In the 'IPv6 HOWTO' [3] I found: > > "Since clients only use the ORPort (because it's more anonymous2), and > relays only use IPv4, there is no reason to configure an IPv6 DirPort - > if you do, it will never be used." > > Hmm - 'relays only use IPv4' seems to be true. Until now I can see only > incoming connections from the authorities; no other IPv6 and no outgoing > IPv6 connection while on [1] there are over 6800 und on [2] over 4800 > IPv4 connections! > > So I wonder: Does it make sense to setup IPv6 non-exit relays when IPv6 > is not used? Or must I wait patiently - how long? If your relay becomes a Guard, a small number of clients will use its IPv6 ORPort. We want to use IPv6 more in tor, but we have to write the code to do it, and work out if it has any anonymity issues. I updated the wiki page so it is clearer: https://trac.torproject.org/projects/tor/wiki/doc/IPv6RelayHowto?action=dif… > [1] 6A7551EEE18F78A9813096E82BF84F740D32B911 (Tormachine) > [2] 9556D34D97C0382E8B9901B036ACAA2F2B453FEC (Tormachine2) > [3] https://trac.torproject.org/projects/tor/wiki/doc/IPv6RelayHowto T

1 0