- tor-relays - lists.torproject.org

Active MetricsPort logs "Address already in use"
by Alexander Dietrich 25 Mar '21

25 Mar '21

Hello, when I activate the "MetricsPort" feature, the Tor log reports that it is going to open the port, then it says "Address already in use". According to "netstat", the address is indeed in use, but by "tor". Sending GET requests to the address returns empty responses. Any ideas? Kind regards, Alexander -- PGP Key: https://dietrich.cx/pgp | 0x52FA4EE1722D54EB

2 4

Tor 0.4.5.6 and missing IPv6
by Marco Predicatori 25 Mar '21

25 Mar '21

Hi, I've recently upgraded to Tor 0.4.5.6. Everything seems to work fine, but in the notices_log file I have a lot of these lines: [notice] Unable to find IPv6 address for ORPort 9001. You might want to specify IPv6Only to it or set an explicit address or set Address. I don't have IPv6, and any line mentioning IPv6 in the torrc file is commented. Is there anythng I need to do in order to get rid of those notices, or can I just let them be? Thanks, Marco -- https://metrics.torproject.org/rs.html#details/A4E74410D83705EEFF24BC265DE2…

4 10

Security advisory: Please upgrade to today's OpenSSL.
by Nick Mathewson 25 Mar '21

25 Mar '21

Hi, all! There is a new version of OpenSSL out today, with a security advisory that affects Tor. The vulnerability is CVE-2021-3449, as described on https://www.openssl.org/news/secadv/20210325.txt . It affects OpenSSL versions 1.1.1 through 1.1.1j. OpenSSL 1.1.1k is the first version with a fix. I haven't tested this bug, but I believe that it would allow an adversary to remotely crash Tor relays and authorities. It won't have any effect on Tor clients. I suggest that everybody should upgrade to the latest OpenSSL when it becomes available on their platform. best wishes, -- Nick

1 0

Failed upgrade
by r1610091651 24 Mar '21

24 Mar '21

Hi FYI So I've upgraded tor package from 0.4.4.6 to 0.4.5.7-1~xenial+1. No other changes. Yet on startup tor is complaining about mis-configuration: Mar 23 20:55:02.928 [notice] Read configuration file "/usr/share/tor/tor-service-defaults-torrc". Mar 23 20:55:02.929 [notice] Read configuration file "/etc/tor/torrc". Mar 23 20:55:02.932 [warn] Configuration port ORPort 9443 superseded by ORPort <local-ip>:9443 Mar 23 20:55:02.932 [warn] We are listening on an ORPort, but not advertising any ORPorts. This will keep us from building a router descriptor, and make us impossible to use. Mar 23 20:55:02.932 [warn] Failed to parse/validate config: Misconfigured server ports Mar 23 20:55:02.932 [err] Reading config failed--see warnings above. config: ORPort <local-ip>:9443 NoAdvertise ORPort 9443 NoListen IPv4Only AddressDisableIPv6 1 OutboundBindAddress <local-ip> This config is according to spec and worked with 4.4.6. Seems to be related to thes issues, except for me it's blocking: tor fails to start. https://gitlab.torproject.org/tpo/core/tor/-/issues/40300 https://gitlab.torproject.org/tpo/core/tor/-/issues/40302 I had to add 0.0.0.0 as ip to make tor start, although that's not documented... ORPort <local-ip>:9443 NoAdvertise ORPort 0.0.0.0:9443 NoListen IPv4Only Regards

2 1

is this valid bridge config
by gi vian 23 Mar '21

23 Mar '21

hello, i want to run bridge. i have configured using tor relay configurator(1). is this valid or can it be improved. config ------ ORPort auto SocksPort 0 BridgeRelay 1 ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy ServerTransportListenAddr obfs4 0.0.0.0:8042 ExtOrPort auto Log notice file /var/log/tor/notices.log ExitPolicy reject *:* ------ regards, vian (1) https://tor-relay.co/

2 1

Circuit Creation Madness: Anyone else still experiencing (extremely) excessive clients / (possibly) modified relays creating millions upon millions of circuits?
by William Kane 23 Mar '21

23 Mar '21

@tor-relays: Sorry for being quite noisy recently but I really need to know how many people are suffering from the same madness I am encountering right now. Quick excerpt from the log: ... Mar 22 09:48:10 <hostname_redacted> tor[pid_redacted]: Mar 22 09:48:10.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [12420 similar message(s) suppressed in last 120 seconds] Mar 22 09:49:10 <hostname_redacted> tor[pid_redacted]: Mar 22 09:49:10.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [31764 similar message(s) suppressed in last 60 seconds] Mar 22 09:50:10 <hostname_redacted> tor[pid_redacted]: Mar 22 09:50:10.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [104748 similar message(s) suppressed in last 60 seconds] Mar 22 09:51:10 <hostname_redacted> tor[pid_redacted]: Mar 22 09:51:10.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [364165 similar message(s) suppressed in last 60 seconds] Mar 22 09:52:10 <hostname_redacted> tor[pid_redacted]: Mar 22 09:52:10.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [509474 similar message(s) suppressed in last 60 seconds] Mar 22 09:53:10 <hostname_redacted> tor[pid_redacted]: Mar 22 09:53:10.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [241332 similar message(s) suppressed in last 60 seconds] ... This then goes on for a while, stopping at a few million suppressed messages / circuit creation attempts. Sorry, but 1 million circuit creation requests in just 5 minutes, there is no way that this is legitimate behavior we are seeing - this is also what was previously used to get my relay oom-killed but that I have fixed so the legitimate clients hopefully don't suffer too much anymore. If any other relay operators are encountering the same log entries or behavior, please don't hesitate to reply. Added tor-dev(a)lists.torproject.org as a CC as they might want to know about this. @tor-dev: I suspect some kind of denial-of-service attack against onion services or a more targeted attack against singular relays for guard discovery / traffic confirmation attacks. Might be smart to add some code which, if this scenario is triggered, lists offenders by hashes of their signing keys (if relay), or IP addresses (if client). There doesn't seem to be a defense against this, and the new connect() rate-limit added through ticket 40253 also won't handle this as the connection is already ACK'd and established, and a malicious relay with custom source code could do whatever it was programmed to do anyway. - William

2 2

ECONNREFUSED
by tor 23 Mar '21

23 Mar '21

Hi All, I've been running a bridge on my home lan. I'm able to successfully attach to the bridge on the lan and from the wan. There are established circuits and clients: https://metrics.torproject.org/rs.html#details/E120A0492F789F5367EAD84C64F9… According to the tcp reachablilty test everything is reachable. However, the status page keeps saying I'm dysfunctional with a ECONNREFUSED: https://bridges.torproject.org/status?id=E120A0492F789F5367EAD84C64F92EE279… So everything seems to be working on my end. -matt

3 2

Question
by Андрей Гвоздев 23 Mar '21

23 Mar '21

What does it mean "Tor's file descriptor usage is at 90%. If you run out Tor will be unable to continue functioning."?

2 1

Questing regarding Team Cymru Tor Relays and Bridges
by Lisa Winter 23 Mar '21

23 Mar '21

Hello list, I just visited BridgeDB and got a bridge from "Team Cymru", according to the whois of the IP - should the Tor Project really allow a company trying to "track and take down threat actors and criminals around the globe" host a substantial portion of the network, according to their info page: https://team-cymru.com/company/ The following was also very concerning: "Team Cymru is comprised of former…" - ... - Law enforcement - ISP backbone engineers - ... I suspect that they log connections to their relays and bridges, and maybe even more. Such companies profit from gathering and selling information's, exploits and the likes. bad-relays rejected this message, which is concerning.. I hope someone here could redirect it to the right people, or do the Tor Project higher-ups know the people behind Team Cymru and vouch for them? Bye, Lisa Winter

3 3

Sunsetting C3WLittleGem and C3WPhantomStreak
by MacLemon 18 Mar '21

18 Mar '21

Hi! FYI: We sadly have to sunset two of our relays due to persistent network/upling problems with the vSphere cluster of our hosting provider. It wasn't possible to solve these issues in about a year. To reduce our volunteers' time investment for no gain, we'll turn of C3WLittleGem and C3WPhantomStreak in the next few days. If you want to have a last look at them, here's a link to our family. https://metrics.torproject.org/rs.html#search/family:B1F09810C4F7B9D30F483D… We'll continue running C3WEyeOfSauron and hope being able to add more relays again in the future. Best regards MacLemon (on behalf of Chaos Computer Club Wien (C3W))

2 1