TorBox's automatic counteractions (updated 30/10/2022)

[radio24]

With TorBox v.0.4.2, automatic counteractions to avoid downtime and improve user experience with lower bandwidth are introduced. The idea behind this feature is that a routine constantly monitors the tor log file and automatically initiates counteractions if necessary. This feature is especially interesting in places with unstable networks and poor bandwidth. Tor is working very efficiently on a stable network with good bandwidth, but in areas with poor Internet connectivity, tor tends to be "stuck". For example, it is starting to (re-)build circuits that take away CPU power and block clients from using the tor network. Usually, a manual restart helps in such a situation.

Currently, TorBox's automatic counteractions handle six situations:

1. Protection against entry guard failing and overloaded tor network
2. Protection against interrupted WiFi (wlan0/wlan1) connection with the Internet
3. Protection against an excessive number of failing tor circuits (25 failures in 2 minutes)
4. Protection against excessive connection failing with tor circuits (40 failures in 2 minutes)
5. Protection against tor bootstrapping problems (25 failures in 2 minutes)
6. Protection against out-of-sync time

The features are divided into three parts:

• log_check.py: monitors the tor log file
• log_check_config.py: configuration file in which a certain amount of log patterns in a specific time triggers an automatic counteraction
• automat: this script defines the counteraction run if triggered

Before deploying TorBox's automatic countermeasures as standard, what did we consider?

• Were the pattern looking for in the tor log file good enough, and are there other/better patterns to include?
• Were the amount of counted patterns in a specific time appropriately chosen? We don't want to interfere too often with counteractions, but the feature should be practical. These counteractions should avoid the downtime of the connection to the tor network and give a better user experience, especially on connections with lower bandwidth.
• Were the defined counteractions effective, or are there other/better alternatives?
• How can we combine TorBox's automatic counteractions with Vanguards? --> Actually, a combination was not possible, and we need to reassess the added value of Vanguard in future TorBox versions.

Please give us feedback about your experiences with the automatic counteractions! What is your opinion?