- tor-relays - lists.torproject.org

TCP SACK PANIC type kernel vulnerabilities: logging some packets
by tor＠t-3.net 25 Jun '19

25 Jun '19

As of last week there wasn't a new kernel out for our relay's distro, so I implemented an IPTables-based mitigation in our relay as such: -A INPUT -p tcp --tcp-flags SYN SYN -m tcpmss --mss 1:500 -j LOG --log-prefix "TCP_SACK_PANIC: " -A INPUT -p tcp --tcp-flags SYN SYN -m tcpmss --mss 1:500 -j DROP Over the weekend we logged hits to this rule. I checked a few of the source hosts, and they were not relays at least as they are listed in https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1.1.1.1 . I'll pull the rule out once the kernel is patched, but yeah. Things that make you go hmm.

2 1

Re: [tor-relays] Tor memory leak (0.3.5.7)?
by starlight.2018q2＠binnacle.cx 25 Jun '19

25 Jun '19

Hi, No leaks. The VM has 1GB, very light for moderate busy relay. Should be 4GB, perhaps 3DB would do. Settings should include: AvoidDiskWrites 1 DisableAllSwap 1 MaxMemInQueues 1024MB # perhaps 1536MB My relays run about 800MB to 1.2GB. A nice way to view memory usage is with egrep '^Vm' /proc/$(cat /var/run/tor.pid)/status which might show something like VmPeak: 871696 kB VmSize: 710152 kB VmLck: 710148 kB VmHWM: 810872 kB VmRSS: 649328 kB VmData: 492052 kB VmStk: 93 kB VmExe: 4704 kB VmLib: 104724 kB VmPTE: 1044 kB Notice that current VmSize usage is less than VmPeak, indicating that memory was release by glibc malloc. Tor consumes substantial skbuf memory in the kernel, which accounts for some of the difference in reported size for VmRSS and VmSize and total memory consumption.

3 2

Build problem
by dns1983＠riseup.net 25 Jun '19

25 Jun '19

Hello, I'm trying to build tor for from source on a x86 Debian stretch machine. I first installed all dependencies, but when I launch the "./configure" command I see the following error: configure: WARNING: Unable to find liblzma. configure: WARNING: Unable to find libzstd I installed, among the others liblzma-dev, lzma, libzstd-dev and zstd. I'm working through ssh. What I'm doing wrong? Could It be caused by a wrong environment variables settings? Cheers Gigi

2 2

obfs4proxy installation from deb.torproject.org says Release file expired
by s7r 25 Jun '19

25 Jun '19

Hello, Trying to spin some new obfs4bridges. I am using: deb.torproject.org/torproject.org obfs4proxy main in /etc/apt/sources.list -- I hope this is correct. I get this: E: Release file for https://deb.torproject.org/torproject.org/dists/obfs4proxy/InRelease is expired (invalid since 1d 15h 7min 11s). Updates for this repository will not be applied. Just recently saw Yawning's release notification, is it somehow related? Thanks.

2 1

fresh assault on Tor network
by starlight.2018q2＠binnacle.cx 25 Jun '19

25 Jun '19

https://metrics.torproject.org/userstats-relay-country.html?start=2017-06-2…

3 3

Become a Fallback Directory Mirror
by gus 25 Jun '19

25 Jun '19

Dear Relay Operators, Do you want your relay to be a Tor fallback directory mirror? Will it have the same address and port for the next 2 years? Just reply to this email with your relay's fingerprint. If your relay is on the current list, you don't need to do anything. If you're asking: Q: What's a fallback directory mirror? Fallback directory mirrors help Tor clients connect to the network. For more details, see [1]. Q: Is my relay on the current list? Search [2] and [3] for your relay fingerprint or IP address and port. [2] is the current list of fallbacks in Tor. [3] is used to create the next list of fallbacks. Q: What do I need to do if my relay is on the list? Keep the same IP address, keys, and ports. Email tor-relays if the relay's details change. Q: Can my relay be on the list next time? We need fast relays that will be on the same IP address and port for 2 years. Reply to this email to get on the list, or to update the details of your relay. Once or twice a year, we run a script to choose about 150-200 relays from the potential list [3] for the list in Tor [2]. Q: Why didn't my relay get on the list last time? We check a relay's uptime, flags, and speed [4]. Sometimes, a relay might be down when we check. That's ok, we will check it again next time. It's good to have some new relays on the list every release. That helps tor clients, because blocking a changing list is harder. cheers, gus [1] https://trac.torproject.org/projects/tor/wiki/doc/FallbackDirectoryMirrors [2] https://gitweb.torproject.org/tor.git/tree/src/or/fallback_dirs.inc [3] https://gitweb.torproject.org/tor.git/tree/scripts/maint/fallback.whitelist [4] https://trac.torproject.org/projects/tor/attachment/ticket/21564/fallbacks_…

13 19

Re: [tor-relays] Become a Fallback Directory Mirror
by teor 24 Jun '19

24 Jun '19

Hi, > On 24 Jun 2019, at 02:49, tschador(a)posteo.de wrote: > > On 2019-06-23 14:32, teor wrote: > >> But your relay needs a DirPort to be a fallback directory mirror. >> Here are some instructions for different platforms: >> https://trac.torproject.org/projects/tor/wiki/TorRelayGuide#Platformspecifi… > > This should be clarified in the Tor manual [1] too! > > "Tor will contact the authority at ipv4address to download directory > documents. The provided port value is a dirport; clients ignore this in > favor of the specified "orport=" value. If an IPv6 ORPort is supplied, > Tor will also download directory documents at the IPv6 ORPort." > > Am I right that for fallback directory mirrors DirPort is needed but > ignored by clients? It is needed to make sure that the relay serves directory documents. We run a script that uses the DirPort to check the download speed. > Possibly this explains why I lost the fallback > directory flag since I have removed the DirPort in torrc … Fallbacks need the same ports, IP addresses, and keys for 2 years. That includes the DirPort. It's not possible to configure a fallback without a dirport: FallbackDir ipv4address:port orport=port id=fingerprint [weight=num] [ipv6=[ipv6address]:orport] (The first port is a dirport, and both dirport and orport are required.) I have updated the template: https://trac.torproject.org/projects/tor/wiki/doc/UpdatingFallbackDirectory… And opened a ticket for the man page: https://trac.torproject.org/projects/tor/ticket/30955 T

1 0

Tor memory leak (0.3.5.7)?
by Roman Mamedov 23 Jun '19

23 Jun '19

Hello, As sometimes happens, I notice my nodes getting into swap heavily. This time: ------------ KiB Mem: 1010576 total, 897388 used, 113188 free, 5144 buffers KiB Swap: 1048572 total, 123592 used, 924980 free. 61732 cached Mem PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 4740 debian-+ 25 5 565448 259032 15204 R 63.2 25.6 1621:47 tor 4765 debian-+ 25 5 491636 200812 13136 S 32.9 19.9 678:36.65 tor total used free shared buffers cached Mem: 1010576 870392 140184 4 1144 64604 -/+ buffers/cache: 804644 205932 Swap: 1048572 123592 924980 ------------ After killing PID 4740 and starting that instance again (now PID 25456): ------------ KiB Mem: 1010576 total, 691264 used, 319312 free, 4336 buffers KiB Swap: 1048572 total, 58624 used, 989948 free. 209692 cached Mem Unknown command - try 'h' for help PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 4765 debian-+ 25 5 491636 195900 8584 R 38.3 19.4 678:56.29 tor 25456 debian-+ 20 0 441092 240824 140452 S 29.9 23.8 0:28.48 tor total used free shared buffers cached Mem: 1010576 663816 346760 12 4344 209692 -/+ buffers/cache: 449780 560796 Swap: 1048572 58624 989948 ------------ How come killing a Tor instance which was shown to be using 259 MB of RAM, has freed up 355 MB, even counting the new copy of Tor which was started in its place and is already using 240 MB? The math only adds up to 19 MB delta, not 355. As this memory usage doesn't seem to be attributed to Tor, it reminds me of that major memory leak which was fixed some time ago, so maybe it was not fixed entirely? -- With respect, Roman

1 0

Re: [tor-relays] tor update question
by Olaf Grimm 21 Jun '19

21 Jun '19

On Website: "update to latest upstream release (bz#1679732) How to install sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-EPEL-2019-f8311ec8a2" Not working! The command there is "dnf". A replacement with "yum" get the following error on my system: "[root@75f449 ~]# yum upgrade --enablerepo=updates-testing --advisory=FEDORA-EPEL-2019-f8311ec8a2 Geladene Plugins: fastestmirror Error getting repository data for updates-testing, repository not found [root@75f449 ~]# " Any other solution available? Olaf Am 20.06.19 um 21:31 schrieb nusenu: >> I am running Centos7 (CentOS Linux release 7.6.1810 (Core)) and Tor >> v. 0.3.5.7. Now I see in nyx that is is unrecommended, but the epel >> repo doesn't have 0.3.5.8. Should I be adding another repo, or just >> wait, or try to compile my own? > You can get tor 0.3.5.8 on CentOS 7 by enabling the updates-testing repo > > https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-f8311ec8a2 > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

tor update question
by torix＠protonmail.com 20 Jun '19

20 Jun '19

Dear List, I am running Centos7 (CentOS Linux release 7.6.1810 (Core)) and Tor v. 0.3.5.7. Now I see in nyx that is is unrecommended, but the epel repo doesn't have 0.3.5.8. Should I be adding another repo, or just wait, or try to compile my own? TIA, --Torix Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1