- tor-relays - lists.torproject.org

Tor DDoS Mitigation iptables scripts updated to version 3.0.0
by Chris 09 Nov '22

09 Nov '22

1 0

Middle relay and snowflake
by andrew reid 09 Nov '22

09 Nov '22

Is it possible to run a tor relay and a snowflake on the same IP. I have had the snowflake add on installed on my browser for a few months and noticed it has never gotten any traffic. Is this because of the tor relay on the same IP ?

1 0

State of the Onion 2022
by Gaba 08 Nov '22

08 Nov '22

Hi! We're happy to announce that the State of the Onion, a livestream event highlighting updates from onion-world over the last year, is returning this month! This year, we'll State of the Onion will be a two-part event: - Wednesday, Nov 9, State of the Onion: the Tor Project @ 17:00-18:30 UTC: https://www.youtube.com/watch?v=uSyBZ7GIzJY - Wednesday, Nov 16, State of the Onion: the Tor community @ 17:00-18:30 UTC: https://www.youtube.com/watch?v=O-7k0PjnBbk Everyone is invited to hear news, accomplishments, challenges, and next steps of all the Tor Project's teams + Tor community projects during these live events. More information about the Tor Project's event in https://blog.torproject.org/state-of-the-onion-2022/ cheers, gaba -- pronouns she/her/they GPG Fingerprint EE3F DF5C AD91 643C 21BE 8370 180D B06C 59CA BD19

1 0

preventing DDoS is more than just network filtering
by Toralf Förster 07 Nov '22

07 Nov '22

The graphs in [1] and [2] are IMO good examples related to [3]: "... in addition to network filtering, the (currently) sharp input signal ... is transformed into a smeared output response ... This shall make it harder for an attacker to gather infromation using time correlation techniques." Feedback is welcome. [1] https://github.com/toralf/torutils/blob/main/doc/network-metric.svg [2] https://github.com/toralf/torutils/blob/main/doc/network-metric-nextday.svg [3] https://github.com/toralf/torutils/tree/main#block-ddos-traffic -- Toralf

1 0

Need a little assistance with a relay
by Ronvau 05 Nov '22

05 Nov '22

Hello Tor, I am looking to set up a relay but have not been successful yet. ALthough I believe I followed instructions, the relay "Walton" does not appear to be functioning as I would expect. I was using SNAP as a vehicle to launch the relay but no luck there as it fails as well. Is there anyone that can work with me to get this relay up and online?? Thank you.Ron V.

3 3

Re: [tor-relays] security update for obfs4proxy
by Toralf Förster 03 Nov '22

03 Nov '22

On 10/14/22 19:09, meskio wrote: > The upstream changelog is here: > https://gitlab.com/yawning/obfs4/-/blob/master/ChangeLog > But I understand is not easy to understand what the problem is from that > changelog. Indeed. BTW the fix was made 5 weeks ago, so I do assume, the (eg. Debian) package needed time to stabilize, or ? -- Toralf

3 3

My bridge has no distribution mechanism
by Keifer Bly 30 Oct '22

30 Oct '22

https://metrics.torproject.org/rs.html#details/4D6E3CA2110FC36D3106C86940A1… Hey, So my bridge, listed above, says it has no distribution mechanism. Does this mean it is not currently being used? Thank you. --Keifer

1 0

DoS attacks -- status update
by Georg Koppen 28 Oct '22

28 Oct '22

Hello everyone! It's been a while since we last provided some update on this mailing list about our ongoing work fighting several DoS attacks. We can use the attached graph about detected overload over the last couple of months to show what is going on and what we do/plan to do about it. The first noteworthy incident on that graph is the sharp rise in overloaded non-exit nodes since the middle of July caused by a drop of onionskins[1] which the relay's available CPU/memory can't handle anymore. There are currently two ideas we are working on to cope with such a flood of onionskins: 1. Developing a Proof of Work (PoW) system to has a rate-limitation knob rejecting the load of onionskins while letting legitimate ones through.[2] We still need to solve some design issues (feel free to help!) but hope to have that feature integrated into Tor soon. 2. Relay operators started to experiment with iptables/nftables rules and having the right ones available might be a good stopgap approach against the onionskin related DoS. We are coordinating that effort[3], so we have something available to propose to the wider community, which is kept up-to-date and limits the risks of traffic overblocking. Feel free to help as well with that effort. The other noteworthy incident started around September 13 when exit nodes began to get overloaded (while the other DoS was and is still ongoing). Unfortunately, that exit related DoS is heavily impacting our users' experience as can be seen in our OnionPerf data[4]. While we are still investigating the nature of that DoS attack it turns out that blocking particular IP addresses with ExitPolicy rules seems to help on exit nodes this is tested on. The Artikel10 exit node operators provided even a script recently[5] to help with that (much appreciated, thanks!). This approach is highly experimental at this point and it might help us at least to come up with an actual design idea to counter that particular exit DoS. Thanks, Georg [1] For information about overload in general and what "drop of onionskins" means, see: https://support.torproject.org/relay-operators/#relay-bridge-overloaded. It contains as well a guide on how to enable MetricsPort monitoring yourself so you see the actual metrics of your own relay. [2] https://gitlab.torproject.org/tpo/core/tor/-/issues/40634 [3] https://gitlab.torproject.org/tpo/community/support/-/issues/40093 [4] https://metrics.torproject.org/torperf.html [5] https://lists.torproject.org/pipermail/tor-relays/2022-October/020848.html

1 0

MetricsPort: tor_relay_connections_total type confusion
by nat＠danwin1210.de 28 Oct '22

28 Oct '22

Hello David, again, thanks for your work on adding more metrics to tor's MetricsPort! Many relay operators will love this and documentation will be useful [1]. I reported https://gitlab.torproject.org/tpo/core/tor/-/issues/40699 which got closed yesterday, but there was likely a misunderstanding and the changes did not solve the underlying issue. The core issue is: The metric called tor_relay_connections(_total) [2][3] contains a mix of different types (gauge, counter). When mixing types in a single metric, the TYPE definition will always be wrong for one or the other value. For example grafana will show this if you use a counter metric without rate(): "Selected metric is a counter. Consider calculating rate of counter by adding rate()." It is a best practice to avoid mixing different types in a single metric. >From the prometheus best practices [4]: "As a rule of thumb, either the sum() or the avg() over all dimensions of a given metric should be meaningful (though not necessarily useful). If it is not meaningful, split the data up into multiple metrics. For example, having the capacity of various queues in one metric is good, while mixing the capacity of a queue with the current number of elements in the queue is not." An idea to address the underlying issue: One connection metric for counter and one for gauge: - tor_relay_connections_total for counters, like the current label state="created" - tor_relay_connections for gauge metrics, like the current label state="opened". "rejected" also appears to be a gauge metric. Another nice feature of these metrics would be to have a label for what type of system is connecting (src="relay", src="non-relay") - more on that in yesterday's email. A tool by toralf [4] also shows these and uses the source IP but tor itself does not need to look at the source IP to determine the type, something discussed in last week's relay operator meetup. best regards, nat [1] https://gitlab.torproject.org/tpo/web/support/-/issues/312 [2] https://gitlab.torproject.org/tpo/core/tor/-/commit/06a26f18727d3831339c138… [3] https://gitlab.torproject.org/tpo/core/tor/-/commit/6d40e980fb149549bbef5d9… [4] https://prometheus.io/docs/practices/naming/

2 2

Upcoming OpenSSL 3 security bugfix release
by Georg Koppen 28 Oct '22

28 Oct '22

Hello relay operators! If you are running OpenSSL 3 please be aware that you might need to upgrade it to 3.0.7 as fast as possible on next Tuesday (Nov 1). In an announcement[1] it got said 3.0.7 fixes a CRITICAL security issue. Operators running on the 1.1 series are fine as far as we know so far. Georg [1] https://www.openwall.com/lists/oss-security/2022/10/25/4

1 0