Stream Isolation

Introduction[edit]

If you install custom applications and do not explicitly take precaution against identity correlation through Tor circuit sharing, you risk that different activities, let's say Web (Chromium or similar) or IRC (mIRC or similar) go through the same Tor circuit and exit relay. Even though you would still be anonymous, i.e. the Tor exit relay would still not know your real IP/location, they can easily correlate those activities issued by different applications to the same pseudonym.

The following graphic illustrates the difference of using Tor SocksPort's compared to using Tor's TransPort. Using dedicated Tor SocksPort's per application results in taking different routes through the Tor network per application. Not necessarily all nodes (first, second, third) get replaced by Tor. Sometimes just the first, sometimes just the second, sometimes just the third, and sometimes multiple nodes change.

Stream Isolation Graphic

Whonix ™ implements protection against identity correlation through Tor circuit sharing for preinstalled applications, however, for better privacy, you are still advised to understand a bit of the technical background. Since Tor version 0.2.3, different Socks,- Dns-, or TransPorts go through different Tor circuits, therefore preventing identity correlation. Whonix ™ configures most applications that come preinstalled with Whonix ™ to use different SocksPort, thus no identity correlation is at risk. Whonix ™ uses either socks proxy settings to direct various applications to different SocksPorts or uwt ^[archive] (more information below).

Any other traffic (i.e. custom installed applications, misc applications, such as nslookup, go through Tor's Dns-, and/or TransPort (can be optionally disabled, see below).

List[edit]

Related:

• Whonix ™ Default Application Policy
• Should strict stream isolation by a requirement in Whonix's Default Application Policy? ^[archive]

Applications in Whonix ™ that are either prepared or fully pre-configured to prevent identity correlation through Tor circuit sharing:

By Settings[edit]

By uwt wrapper[edit]

none[edit]

Details[edit]

The required socks proxy settings are setup by various Whonix ™ configuration packages or uwt wrappers, which are set up on Whonix-Gateway ™ and on Whonix-Workstation ™. uwt ^[archive] is a wrapper around torsocks, which is also already installed to /usr/bin/uwt.

• Example, each time you run a uwt wrapped application, i.e. simply type apt-get in console, the uwt wrapper /usr/bin/apt-get will run. It adds uwt before apt-get. For curiosity check nano /usr/bin/apt-get. Essentially, the uwt wrapper then runs /usr/bin/uwt /usr/bin/apt-get.anondist-orig. That is also the case for all other uwt wrapped applications.
• If you ever want or must run a uwt wrapped application without uwt, do not run for example apt-get in console, do run apt-get.anondist-orig. Use cases could be if you want to connect to localhost. If you know what you are doing, you should also be able to deactivate any uwt wrappers you dislike, see #Deactivate_uwt_Stream_Isolation_Wrapper.
• When running /usr/bin/apt-get.anondist-orig it directly goes through Tor's DnsPort and through Tor's TransPort and not through its own SocksPort.
• uwt looks if the command contains the words localhost or 127.0.0.1, if that is the case, uwt will not be used. The command will be run without uwt. Thus, if a localhost connection is falsely detected it will leak, but only through Tor's DnsPort and through Tor's TransPort, which should be acceptable.

Isolate by destination address: Let's assume SSH goes over port 22 and you want to connect to different SSH servers and do not want an observer to be able to correlate that activity to the same pseudonym. If the SSH servers run on different IP's isolate by destination address might help.

Isolate by destination port: This doesn't seem to be useful for anything in Whonix ™, applications using different protocols (and therefore different ports) are already isolated through using different SocksPorts.

Isolate by destination port doesn't really achieve anything for web browsing: tor-talk Tor's stream isolation features defaults ^[archive].

For more information about stream isolation refer to the Tor manual.

• Tor stable manual ^[archive]
• Tor alpha manual ^[archive]

Different tabs and websites in Tor Browser are isolated by since Tor Browser version 4.5-alpha-1. ^[4]

Connections to different Tor Onion Services are automatically stream isolated. ^[5]

Footnotes[edit]

How to mitigate identity correlation[edit]

Transparent Proxy[edit]

This chapter explains what a Transparent Proxy is. It is required to know in order to understand the following chapters.

Transparent proxying means, simplified and specific to Whonix ™:

Application can connect without additional configuration required.

More complex specific to Whonix ™:

application can use TCP/DNS [UDP blocked] over Tor (user -> Tor -> destination) without additional configuration required.

Using Tor Browser on the host without Whonix ™ involved is an example for "no transparent proxying available". ^[1]

Use Telegram in Whonix ™: uses transparent proxying.

Use Firefox on host without Tor: Not sure we should call that "transparent proxying". Should probably not call it that way to avoid confusion. In that case probably the home router is doing "transparent proxying". A proxy that is transparent. It does stuff for the user/program without the user necessarily having to know anything about it.

There are also other types of transparent proxies such as content filtering, virus scanning, and what not.

Whonix-Gateway ™ by default can be used as a Tor Transparent Proxy. Connections from Whonix-Workstation ™ to Whonix-Gateway ™ are transparently proxied through Tor.

Basic Protection[edit]

If you install custom software on Whonix-Workstation ™, that uses the internet, and want to prevent identity correlation through Tor circuit sharing (which you should do), you have to manually configure them. This is not a Whonix ™ specific problem. ^[2] Read also Software installation on Whonix-Workstation ™.

A #list of applications which come pre-installed with Whonix ™ are pre-configured to prevent identity correlation through circuit sharing.

Traffic going through TransPort by default is systemcheck when testing the TransPort. If that is of concern to you, it can be disabled in systemcheck, see prevent polluting TransPort.

All custom installed application's TCP traffic is routed through Tor's TransPort and all their DNS requests through Tor's DnsPort. This means different activities or "identities" in different applications (say browser, IRC, email) end up being routed through the same circuit, thus identity correlation is at risk. ^[3]

To protect against this, you have to set up configure applications to use a dedicated Tor SocksPort. Each custom installed application has to be directed to a dedicated Tor SocksPort, for directions how to do that use the Torify HOWTO ^[archive]. Generally, this can be done either by configuring the application's proxy settings or by using a proxifier (socksifier) such as torsocks.

Multiple Whonix-Workstation ™ are automatically stream isolated. ^[4]

What is better, configure the application's proxy settings or using a proxifier? There can be no generalized answer as this is highly application specific. The most comprehensive documentation of this is the Torify HOWTO. Also a web search could be performed on how to torify applications.

Applications inside Whonix ™ are already torified but by applying these instructions inside Whonix ™ the user would go one step further, i.e. add stream isolation.

Finding up to date instructions for torification is difficult because developing instructions for torification itself is a difficult process. Someone who understands networking needs to leak test if the torification instructions are actually working. Or if there is a leak which means that portion's of the applications's traffic ignore proxy settings and/or circumvent the proxifier and is actually making external connections without using Tor. Such leaks would be much less severe in Whonix ™. It would only result in identity correlation through Tor circuit sharing but not in a leak of the user's real IP address to the destination.

Asking for torification instructions for specific applications at Whonix ™ Free Support is probably futile unless it is a professional support request. The Whonix ™ is the wrong recipient for such support requests. One of the main reasons for the inception of the Whonix ™ was that finding, developing and applying torification instructions is so difficult and one never really knows if it is 100% free of leaks. Even seriously reviewed torification instructions for one application would only apply to the very version which was being reviewed. Not to future versions of the application.

The legacy approach of torification of arbitrary applications on the host seems to been largely given up. There are very few edits to the Torify HOWTO over the years. Nowadays some application developers are providing Tor-safe by default applications, i.e. applications designed for use with Tor in mind and not as an afterthought. Examples include Tor Browser and OnionShare. Also if users are asking how to torifiy specific applications and making sure these are leak free, users are probably told "use Whonix".

Additional comments regarding the Torify HOWTO:

• Warnings about protocol related warnings you must honor. You are still better off with Whonix ™, as it offers best possible Protocol-Leak-Protection and Fingerprinting-Protection.
• Whonix ™ setup provides protection against IP leaks through protocol leaks ^[archive].
• If you do not correctly torify either no connections will be possible or traffic will either continue going through Tor's TransPort unless you disable transparent torification.
• If you redirect more than one application to the same SocksPort, identity correlation is at risk.
• DNS related warnings ^[archive] still apply, though to a lesser extent - an attack could only make correlations but still couldn't figure out your IP. To prevent that see chapter better protection.
  • Do not use a local DNS resolver ^[archive], as all DNS requests would be executed by the same circuit.
• Other leaks, such as applications not honoring the proxy settings / wrapper, ICMP or UDP leaks do not apply to Whonix ™.
• The SafeSocks setting is for rejecting unsafe variants of socks that might cause DNS leaks. The Whonix ™ design model mitigates DNS leaks by redirecting all requests to Tor's DnsPort. Enabling this setting would give marginal benefit in this situation but would complicate debugging.

On Whonix-Gateway ™ there are already a lot custom socks ports prepared for use with custom installed applications ^[5]:

• Without IsolateDestAddr and without IsolateDestPort: SocksPort 9153 to 9159
• With IsolateDestAddr, but without IsolateDestPort: SocksPort 9160 to 9169
• Without IsolateDestAddr, but with IsolateDestPort: SocksPort: 9170 to 9179
• With IsolateDestAddr and with IsolateDestPort: SocksPort: 9180 to 9189
• If those are not enough, you can add your own.

What are IsolateDestAddr and IsolateDestPort? You can learn about them in the Tor manual ^[archive]. See also tor-talk mailing list: Tor's stream isolation features defaults ^[archive]. Usually, unless you know better, you are better off not using IsolateDestAddr or IsolateDestPort.

torsocks application-name

Better Protection[edit]

For best protection against identity correlation:

• Read the advice above and on Whonix-Gateway ™.
• Deactivate KDE / GNOME - application wide proxy settings because those proxy settings are not application specific, but rather force all KDE / GNOME applications through the same SocksPort. There no KDE / GNOME applications which use the internet preinstalled by default. However, deactivating those KDE / GNOME wide proxy settings gives finer control over stream isolation.
• Disable transparent proxying as documented below.

Best Protection[edit]

Best stream isolation is only possible if you honor the advice above and only use one application per session and always revert to a fresh image or Multiple Whonix-Workstation ™. ^[4]

Disable Transparent Proxying[edit]

To deactivate transparent proxying apply the following instructions.

Following these steps will disable the Whonix-Gateway ™ transparent proxying feature and transform Whonix-Gateway ™ into an IsolatingProxy ^[archive].

Note: The following instructions should be applied in Whonix-Gateway ™ (Qubes-Whonix ™: In App Qubes sys-whonix).

1. Modify Whonix-Gateway ™ User Firewall Settings.

sudo mkdir -p /usr/local/etc/whonix_firewall.d

sudoedit /usr/local/etc/whonix_firewall.d/50_user.conf

## Please use "/etc/whonix_firewall.d/50_user.conf" for your custom configuration,
## which will override the defaults found here. When {{project_name}} is updated, this
## file may be overwritten.

nano /etc/whonix_firewall.d/30_whonix_gateway_default.conf

2. Add.

WORKSTATION_TRANSPARENT_TCP=0
WORKSTATION_TRANSPARENT_DNS=0

3. Save.

4. Reload Whonix-Gateway ™ Firewall.

sudo whonix_firewall

^[7]

5. Done.

Deactivating transparent proxying is complete.

This will disable transparent proxying. All applications not configured to use a SocksPort by socks proxy settings or forced to use a SocksPort by a socksifier will not be able to establish connections. This is the only way to ensure that different SocksPorts are used and also that DNS is remotely resolved through that SocksPort.

6. Test.

Optional.

• Check if Transparent DNS is disabled
• Check if Transparent TCP is disabled

IsolateSOCKSAuth[edit]

See Tor manual ^[archive] IsolateSOCKSAuth.

Don’t share circuits with streams for which different SOCKS authentication was provided. [...]

Deactivate Stream Isolation[edit]

Easy[edit]

How to disable stream isolation. Most easy and common methods only. For more options, see below.

Deactivate uwt Stream Isolation Wrapper[edit]

OPTIONAL. Usually not required. Only for special setups and people who know what they are doing.

Temporary[edit]

anondist-orig Method[edit]

Append .anondist-orig to the command you want to run. For example, instead of using.

curl 38.229.72.22

Use.

curl.anondist-orig 38.229.72.22

Environment Variable Method[edit]

Use the UWT_DEV_PASSTHROUGH environment variable. ^[8]

Example. Set the UWT_DEV_PASSTHROUGH environment variable. This will disable using torsocks for all following invocations.

export UWT_DEV_PASSTHROUGH="1"

curl 38.229.72.22

When running as user and using sudo, do not forget sudo parameter -E which stands for preserve environment.

sudo -E apt update

Permanently[edit]

Introduction[edit]

You can enable/disable all uwt stream isolation wrappers globally or enable/disable specific stream isolation wrappers, see uwt /etc/uwt.d/30_uwt_default.conf configuration file.

deactivate all uwt wrappers permanently[edit]

sudoedit /etc/uwt.d/50_user.conf

uwtwrapper_global="0"

Deactivate Misc Proxy Settings[edit]

sudoedit /etc/apt/sources.list /etc/apt/sources.list.d/*

sudoedit /etc/torbrowser.d/50_user.conf

TB_NO_TOR_CON_CHECK=1
CURL_PROXY="--fail"

Tor Browser Remove Proxy Settings[edit]

If you would like to remove proxy settings from Tor Browser, see below.

cd ~/tor-browser_en-US

TOR_TRANSPROXY=1 ./start-tor-browser.desktop

export TOR_TRANSPROXY=1

sudoedit /etc/environment

TOR_TRANSPROXY=1
## newline at the end

Nested Execution[edit]

uwt version 4.0-1 and above protects form endless nested execution which could likely lead to a locked up session by aborting after 10 times an uwt wrapped application calling another uwt wrapped application. In that case, you would see the following error message.

uwtwrapper uwt wrapper ERROR: More than uwtwrapper_counter 10 nested executions (uwtwrapper_max: 10).

This is most likely happening due to two symlinks pointing to each other resulting in endless execution. However, should there be any cases (none could be foreseen at development time) where this is legitimate, feel free to change the setting responsible for aborting execution. Please also consider reporting your use case in Whonix ™ forums so perhaps a better fix for this can be found.

Open file /etc/uwt.d/50_user.conf in an editor with root rights.

sudoedit /etc/uwt.d/50_user.conf

Set uwtwrapper_max to a value more suitable for you.

uwtwrapper_max=100

Alternatively you could completely disable the nested execution protection.

nested_protection() {
    true
}

Save and exit.

Done.

Development[edit]

Information[edit]

See also the Tor manual ^[archive] on SocksPort, HTTPTunnelPort, TransPort and DnsPort.

SocksPort[edit]

A SocksPort is a listen port by Tor which accepts traffic using the socks ^[archive] protocol.

Using a SocksPort is possible by using either:

• application specific socks proxy settings ^[archive]
• wrapper method ^[archive] such as torsocks (which can be automatically prepended using uwt ^[archive]

Traffic on separate SocksPorts is stream isolated by Tor default.

HTTPTunnelPort[edit]

A HTTPTunnelPort is a listen port by Tor which accepts traffic using the HTTP CONNECT method ^[archive].

This is a new feature of Tor.

Traffic on separate HTTPTunnelPorts is stream isolated by Tor default.

Forum discussion:
https://forums.whonix.org/t/tor-can-now-serve-as-http-proxy ^[archive]

TransPort[edit]

TransPort is a feature where Tor accepts raw traffic on a listen port if redirected there using iptables. See also TransparentProxy ^[archive].

When using Transparent Proxying (default in Whonix ™) (see this page for Transparent Proxying for more information), all applications that do not use a SocksPort or HTTPTunnelPort will fall back to be using Tor's TransPort for TCP. I.e. using system default networking. This is also called transparent proxying.

There is no stream isolation for TransPort connections unless originating from a separate Whonix-Workstation ™. ^[4]

DnsPort[edit]

Similar to above but for DNS. All applications that do not use a SocksPort or HTTPTunnelPort will fall back to be using Tor's DnsPort for DNS.

torsocks[edit]

All uwt wrapped applications will be stream isolated by torsocks ^[archive] /etc/tor/torsocks.conf setting IsolatePID 1.

To test this, run multiple times the following command.

scurl https://check.torproject.org | grep IP

Tests[edit]

1. Applications which internally use curl.

sudo update-command-not-found

sudo update-flashplugin-nonfree --install --verbose

2. Applications which is uwt wrapped itself and internally uses ssh.

git push origin master

3. Enigmail.

Debugging / List of all uwt wrappers[edit]

sudo dpkg-divert --list

ls -la /usr/bin/ssh

Deactivating an uwt wrapper[edit]

Example:

sudo unlink /usr/bin/ssh

sudo dpkg-divert --rename --remove /usr/bin/ssh

Check if Transparent DNS is disabled[edit]

Note: The following test should be performend in Whonix-Workstation ™ (Qubes-Whonix ™: App Qube anon-whonix).

Test.

nslookup check.torproject.org ; echo $?

Expected output.

;; connection timed out; no servers could be reached

1

If it shows something else, such as a resolved IP, the Transparent DNS is enabled.

Check if Transparent TCP is disabled[edit]

Note: The following test should be performend in Whonix-Workstation ™ (Qubes-Whonix ™: App Qube anon-whonix).

Test.

UWT_DEV_PASSTHROUGH=1 curl 116.202.120.181 ; echo $?

Expected output.

curl: (7) couldn't connect to host
7

If it shows something else, such as the html source code, then Transparent TCP is enabled.

Check if Transparent Proxying is disabled[edit]

Note: The following test should be performend in Whonix-Workstation ™ (Qubes-Whonix ™: App Qube anon-whonix).

Test.

UWT_DEV_PASSTHROUGH=1 curl https://check.torproject.org/ ; echo $?

Expected output.

curl: (6) Couldn't resolve host 'check.torproject.org'
6

If it shows something else, such as the html source code, then Transparent Proxying is enabled.

Check if an Application is properly using Stream Isolation[edit]

• Same as leak testing as if Whonix ™ is not involved.
• Also... A weaker test... The transparent proxying disablement test.

Disable transparent proxying of DNS and TCP as per #Better Protection.

Check that worked as per:

• Check if Transparent DNS is disabled
• Check if Transparent TCP is disabled

That is because it doesn't work without transparent proxying (system default networking), meaning application unable to use network normally, then there is a certain socks leak, meaning certainly some traffic which requires system default networking. In case of:

• clearnet operating systems: a clearnet leak
• Whonix ™: a stream isolation violation

This is only weak test since an application could very likely try socks first and if socks fails, fall back to system default networking. Therefore, normal leak testing is required.

• Internet research if application was specifically designed for use with Tor.
• Internet research if application was specifically audited for clearnet leaks.
• Discussion with software contributor about this if these haven't already happened.
• https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorifyHOWTO#Howtoreviewanapplication ^[archive]
• https://lists.torproject.org/pipermail/tor-talk/2012-April/024010.html ^[archive]
• https://gitlab.torproject.org/legacy/trac/-/issues/5553 ^[archive]
• corridor - Tor traffic whitelisting gateway ^[archive]

Add new uwt wrapper[edit]

Emulate this commit ^[archive].

Sources[edit]

• Separate streams across circuits by connection metadata ^[archive]
• tor-talk Operating system updates / software installation behind Tor Transparent Proxy ^[archive]
• tor-talk Awareness for identity correlation through circuit sharing is almost zero. ^[archive]
• tor-talk Tor's stream isolation features defaults Question ^[archive]
• tor-talk Tor's stream isolation features defaults Answer ^[archive]
• Tails-dev separate Tor streams ^[archive]
• Tails separate Tor streams ^[archive]
• Tails-dev Please review Tails stream isolation plans ^[archive]
• Tails Design: Tor stream isolation ^[archive]

Stream Isolation Graphic has been contributed by: Cuan Knaggs – graphic and web design revlover ^[archive] print media – web design – web development – cms – e-commerce

References[edit]

	100px
Fosshost	About Advertisements

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

Follow:

Support:

Donate:

Priority Support | Investors | Professional Support

Whonix ™ | © ENCRYPTED SUPPORT LP | Freedom Software / Open Source (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.