From owner-freebsd-security@FreeBSD.ORG Sun Nov 9 19:16:18 2014 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 8840B93F; Sun, 9 Nov 2014 19:16:18 +0000 (UTC) Received: from snorky.mixmin.net (snorky.mixmin.net [IPv6:2a01:4f8:100:5243::3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 191D2C05; Sun, 9 Nov 2014 19:16:17 +0000 (UTC) Received: by snorky.mixmin.net (Postfix, from userid 1011) id 3BA2DEAB3B; Sun, 9 Nov 2014 19:15:42 +0000 (GMT) Authentication-Results: snorky.mixmin.net; dkim=fail reason="verification failed; unprotected key" header.d=gmail.com header.i=@gmail.com header.b=m/Qoe9HI; dkim-adsp=none (unprotected policy); dkim-atps=neutral X-Old-Original-To: nymserv@mixmin.net Delivered-To: nymserv@mixmin.net Received: by snorky.mixmin.net (Postfix, from userid 110) id 6ED13EADBA; Fri, 7 Nov 2014 21:07:04 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on snorky.mixmin.net X-Spam-Level: X-Spam-Status: No, score=-2.8 required=6.0 tests=DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_MED,RP_MATCHES_RCVD, T_DKIM_INVALID autolearn=unavailable autolearn_force=no version=3.4.0 Received: from eugeni.torproject.org (eugeni.torproject.org [IPv6:2620:0:6b0:b:1a1a:0:26e5:480d]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by snorky.mixmin.net (Postfix) with ESMTPS id 149B3EAEEF for ; Fri, 7 Nov 2014 21:07:02 +0000 (GMT) Received: from eugeni.torproject.org (localhost [127.0.0.1]) by eugeni.torproject.org (Postfix) with ESMTP id 4069431286; Fri, 7 Nov 2014 21:06:56 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by eugeni.torproject.org (Postfix) with ESMTP id A46BE27DEB for ; Fri, 7 Nov 2014 21:06:52 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at Received: from eugeni.torproject.org ([127.0.0.1]) by localhost (eugeni.torproject.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7zKFqRiO0NOv for ; Fri, 7 Nov 2014 21:06:52 +0000 (UTC) Received: from mail-vc0-x233.google.com (mail-vc0-x233.google.com [IPv6:2607:f8b0:400c:c03::233]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (not verified)) by eugeni.torproject.org (Postfix) with ESMTPS id 7C9BF2697B for ; Fri, 7 Nov 2014 21:06:52 +0000 (UTC) Received: by mail-vc0-f179.google.com with SMTP id ij19so2185863vcb.24 for ; Fri, 07 Nov 2014 13:06:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=Q8Bwf9rQwuFMx01aXD8aOzVraH2Q+lTxJLoP6htJ2dw=; b=m/Qoe9HIldtUqe1tl2UGTbANmZfpK9CC/Oa3Xz/9U9z78Y/oH/li1mrR/N7308HUlp Mj61xFBS6cpeQp2XxVg3Qo4bWok6upA93kzIPurOQ7A+xNQVhKR8XMwwoDds/nrw7TZ6 dcXL5B4qTV4z4mq7FeWYC8ZISwq3BQ8nPs+gFi7DK/2Ikgc7qD1aFKkAg9hcv0hZTgz6 r2dJr/TbPtocVfRKyUkYdS/2fv2BIOp1JFwlNgJhwjdYuCWvGtTW3SkYGM5u0VEEmqCp pTH6kuk4Z4oTwLIwh9nvUr8aR+q4J9tjWVqeFp97lAQUibpdQGQ6AOFarCc1/ucWG0Yw RQsg== MIME-Version: 1.0 X-Received: by 10.221.38.66 with SMTP id th2mr9320080vcb.21.1415394410134; Fri, 07 Nov 2014 13:06:50 -0800 (PST) Received: by 10.221.64.74 with HTTP; Fri, 7 Nov 2014 13:06:50 -0800 (PST) In-Reply-To: References: <20141106135228.GE3824@nymity.ch> Date: Fri, 7 Nov 2014 16:06:50 -0500 Message-ID: From: grarpamp To: tor-relays@lists.torproject.org Subject: Re: [tor-relays] FreeBSD's global IP ID (was: Platform diversity in Tor network) X-BeenThere: tor-relays@lists.torproject.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: tor-relays@lists.torproject.org Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: tor-relays-bounces@lists.torproject.org Sender: "tor-relays" X-Mailman-Approved-At: Sun, 09 Nov 2014 20:32:36 +0000 Cc: FreeBSD Net , freebsd-security@freebsd.org X-BeenThere: freebsd-security@freebsd.org List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Nov 2014 19:16:18 -0000 On Fri, Nov 7, 2014 at 11:31 AM, Adrian Chadd wrote: > ... that's .. odd. > > Let's poke the freebsd crypto and network stack people and ask. I > can't imagine why this is a problem anymore and we should default to > it being on. I don't think there's a crypto@ list, though security@ might represent. > The other thing you could do is have the tor port require > it be turned on before tor runs. That would not cover people who compile and use upstream Tor. Ideally, the Tor client could check for any system parameters it feels are critical before running, or simply delegate them and/or any parameters of lesser importance to platform specific guides on the Tor wiki. > On 7 November 2014 00:20, grarpamp wrote: >> On Thu, Nov 6, 2014 at 8:52 AM, Philipp Winter wrote: >>> >>> FreeBSD still seems to use globally incrementing IP IDs by default. >>> That's an issue as it leaks fine-grained information about how many >>> packets a relay's networking stack processes. (However, nobody >>> investigated the exact impact on Tor relays so far, which makes this a >>> FUD-heavy topic.) It looks like approximately 50 out of the 131 FreeBSD >>> relays I tested (38%) use global IP IDs. >>> >>> There's a sysctl variable called "net.inet.ip.random_id" which makes a >>> FreeBSD's IP ID behaviour random. FreeBSD relay operators should set >>> this to "1". >>> >>> Note that this issue was already discussed earlier this year in a thread >>> called "Lots of tor relays send out sequential IP IDs; please fix >>> that!". >> >> It's been default off since before it was a sysctl over a decade ago. >> Anyone know what the deal is with that? Some objection, or >> forgotten flag day, or oversight that really should be set to 1? >> https://svnweb.freebsd.org/base?view=revision&revision=133720 _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays