Discussion:
[tor-dev] Dealing with DNS requests by Tor unaware programs
procmem
2018-06-24 16:41:40 UTC
Permalink
Hello. We are trying to safely deal with programs that don't support Tor
DNS stream isolation so they don't pollute TransPort.

I've read the manual but it's not clear if you enable
IsolateClientProtocol by default. Is that the case?

Also if the former is enabled, do you have IsolateDest enabled for
DnsPort or not? If no then what is the rationale for this decision?

Thanks.
teor
2018-06-24 23:36:03 UTC
Permalink
Post by procmem
Hello. We are trying to safely deal with programs that don't support Tor
DNS stream isolation so they don't pollute TransPort.
We don't recommend TransPort for this reason. (See below.)
Post by procmem
I've read the manual but it's not clear if you enable
IsolateClientProtocol by default. Is that the case?
No, but you're probably looking for *Port isolation instead,
which is documented as on by default under SessionGroup:

By default, streams received on different SocksPorts,
TransPorts, etc are always isolated from one another.
This option overrides that behavior.
https://www.torproject.org/docs/tor-manual.html.en

The other default isolation flags are documented in the man
page:
IsolateClientAddr and IsolateSOCKSAuth
There are also some internal flags that are always on:
https://gitweb.torproject.org/tor.git/tree/src/or/or.h#n1673

All the isolation flags that aren't named as defaults are not defaults.
Post by procmem
Also if the former is enabled, do you have IsolateDest enabled for
DnsPort or not? If no then what is the rationale for this decision?
I don't think IsolateDest makes sense for DNSPort. Building a
separate circuit for each DNS request is slow (for clients) and
expensive (for the network).

And regardless of isolation, resolving DNS addresses at a
different exit to the one that connects can cause privacy issues,
and it can result in slower connections.

So we recommend SOCKSPort or HTTPTunnelPort instead, because
they support sending DNS names to exits as part of the connection
request.

Here are a few general reasons for the defaults:
* many applications expect to have a single source IP address
for all their connections, and
* building a circuit for each destination is expensive, but
* isolating different users is important, so we automatically
isolate different source IP addresses, and automatically isolate
applications which have different socks usernames or passwords
(users or developers should configure each application with a
random socks username and password)

T
Rusty Bird
2018-06-25 12:35:54 UTC
Permalink
This post might be inappropriate. Click to display it.
Loading...