According to Jacob Appelbaum on Thu, Dec 04 2014: > On 12/4/14, Oliver-Tobias Ripka <o...@bockcay.de> wrote: > > According to anonym on Thu, Dec 04 2014: > > > >> FWIW I experienced no issues during my tests with *only* ESTABLISHED in > >> both the INPUT and OUTPUT chains so neither NEW nor RELATED seems > >> essential for the basic usage I tested. And of course the above > >> "exploits" didn't work due to the absence of NEW. > > > > You're right it work with ESTABLISHED only. This is due to whitelisted > > rule for the debian-tor user that may send any kind of packet. > > That is what I'd expect, yes. We should also tighten that user down as > well. What do you think for the first iteration?
For the first iteration it is probably good to implement the changes suggested by you and tweaked by anonym: that is to narrow the stateful rules down to ESTABLISHED. At the same time we should be able to change the debian-tor rule to allow only NEW TCP packets, disallowing all other protocols. For the potential PATH MTU problem I saw Tor using fixed sizes segments that are quite small (about 500bytes). Thus PATH MTU should not be a problem besides extreme cases of network misconfiguration. Actually it might be a good idea to block these messages because if the network stack reacted to these ICMP messages it might allow a remote attacker to artificially lower the MTU of the segments sent. This may potentially make it easier to deanonymize a Tor user, I guess. Not sure if Tor can protect against this kind of attack as this may happen on the Kernel layer. You asked how to test it. Well I currently don't have a real router which I can configure to provide such a low MTU. But using software tools it is possible to simulate this: 1. route Tails through a Linux box with low MTU on the WAN interface. (Linux should send ICMP DF) 2. route Tails through Linux box with iptables rule dropping large packets and scapy script sniffing an sending ICMP DF for each large packet. Cheers, Olli _______________________________________________ Tails-dev mailing list Tails-dev@boum.org https://mailman.boum.org/listinfo/tails-dev To unsubscribe from this list, send an empty email to tails-dev-unsubscr...@boum.org.