From owner-freebsd-net@FreeBSD.ORG Fri Nov 7 21:41:58 2014 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 0959B442; Fri, 7 Nov 2014 21:41:58 +0000 (UTC) Received: from anubis.delphij.net (anubis.delphij.net [64.62.153.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "anubis.delphij.net", Issuer "StartCom Class 1 Primary Intermediate Server CA" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id DCB1169; Fri, 7 Nov 2014 21:41:57 +0000 (UTC) Received: from zeta.ixsystems.com (unknown [12.229.62.2]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by anubis.delphij.net (Postfix) with ESMTPSA id 963661A418; Fri, 7 Nov 2014 13:41:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=delphij.net; s=anubis; t=1415396511; x=1415410911; bh=yPCw94Bbzu2Zrx7Mbr7gS9IOhJmfx02rf3OWSC7DJ7k=; h=Date:From:Reply-To:To:CC:Subject:References:In-Reply-To; b=tnXKOvMfC7iG3JFFMfCZ5CdoDsQvD3kr3VUUqbJjGdLRSD9LyW6RRrXYumFSo8XBb 2q+q7cIN9KEzLv6mB60hLoej+QeVCk66CcjXjM8qGowshJH8RJ/yTtxwTL6iRd0Tx0 6y4ftyYhee5PrkTKJTQ9UU5WXj4ooa+EkZNbNA30= Message-ID: <545D3C9E.2000201@delphij.net> Date: Fri, 07 Nov 2014 13:41:50 -0800 From: Xin Li Reply-To: d@delphij.net Organization: The FreeBSD Project MIME-Version: 1.0 To: Adrian Chadd , grarpamp Subject: Re: [tor-relays] FreeBSD's global IP ID References: <20141106135228.GE3824@nymity.ch> In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit Cc: tor-relays@lists.torproject.org, FreeBSD Net X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Nov 2014 21:41:58 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On 11/07/14 08:31, Adrian Chadd wrote: > ... that's .. odd. > > Let's poke the freebsd crypto and network stack people and ask. I > can't imagine why this is a problem anymore and we should default > to it being on. The other thing you could do is have the tor port > require it be turned on before tor runs. If I remember correctly, it wasn't about security but about performance, the idea was to make the option per-interface (so that e.g. for internal, fast connection, don't bother to do it), but that never happen. I personally enable it on all my systems to sink away more kernel arc4rand output (which is, unfortunately a side effect of wrong (IMO) behavior, because the current generation code is rather unoptimized and does arc4rand() for each IP ID generated). The NetBSD implementation is superior than ours in my opinion as it uses Fisher-Yates shuffle instead of doing arc4rand (modern version even uses a lighter weighted PRNG for those who do not need strong cryptographical strengths) every time then test for collision, and is therefore more scalable. See: http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/netinet/ip_id.c?only_with_tag=MAIN Cheers, > -adrian > > On 7 November 2014 00:20, grarpamp wrote: >> On Thu, Nov 6, 2014 at 8:52 AM, Philipp Winter >> wrote: >>> On Wed, Nov 05, 2014 at 04:04:41AM -0500, grarpamp wrote: >>>> 173 FreeBSD >>> >>> FreeBSD still seems to use globally incrementing IP IDs by >>> default. That's an issue as it leaks fine-grained information >>> about how many packets a relay's networking stack processes. >>> (However, nobody investigated the exact impact on Tor relays so >>> far, which makes this a FUD-heavy topic.) It looks like >>> approximately 50 out of the 131 FreeBSD relays I tested (38%) >>> use global IP IDs. >>> >>> There's a sysctl variable called "net.inet.ip.random_id" which >>> makes a FreeBSD's IP ID behaviour random. FreeBSD relay >>> operators should set this to "1". >>> >>> Note that this issue was already discussed earlier this year in >>> a thread called "Lots of tor relays send out sequential IP IDs; >>> please fix that!". >> >> It's been default off since before it was a sysctl over a decade >> ago. Anyone know what the deal is with that? Some objection, or >> forgotten flag day, or oversight that really should be set to 1? >> https://svnweb.freebsd.org/base?view=revision&revision=133720 - -- Xin LI https://www.delphij.net/ FreeBSD - The Power to Serve! Live free or die -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0 iQIcBAEBCgAGBQJUXTyeAAoJEJW2GBstM+nscFkP/3AZyfGcZ+guYAXKg2fXUeNL 2A6upXx5Vtb7xMyTeCSfccGMtvc/IsGjWNrN8m8gC1xo304RDE9ChxZKUwtbSjNz twSIACF26F1wUmyFXPAqyNu3m9Id1KET4ttW+XO8cCDZegoyzm4O+xnMQY6PkhtT czf9VfONFzMM/ZPwFEClWsVcxNnIL6rGgDRUF0TJOPijwRSdp14MUNPTfYJT8JZ0 xL/KSYwK228S0AtGJXEyh8JXn6ejNYZBC1A9bvZWzPeKFDbfS20hJfPbs7N2NBCf KqE4EEAVikJ0DRjB7qBhm09mAA0Igg2K5WROcuT5RoOgLL4vj/DPa6LGaBqxgCBT 9NiqTuefcoLjXKWcYNLuRxaBgPuERXm4J9CdIWIn1X9QXSx+En++JHMiuqUT+8fW qSmlXve0zOIpnLoIZ7mlpMDwpQe2YWWf3eNhDVtsZLr+ra3pd95gQaf3aOvAJpJQ 8syLAyso5GkR+uQK9/mT7L3IH8VuiGAGzVrmdXXd0GewQct7flBymWCnUb8yUF6F O8+MMJOF7WWbtRBW45boWhoHl7K9JFtznDiZxZ/ef0P2LP+C6tk2DtjNtXWKRw6M Fg8ZK2FsFj0QiYuN7rdHWASLUjQCM08VnGItPbaIK1mnEa5RR66jgbLckbsTzCpP u9TA361AfS2/MER6RNdF =zRJy -----END PGP SIGNATURE-----