From 0aad75fe7082dc46bba21f76fcf640f370febb35 Mon Sep 17 00:00:00 2001 From: Evgeny Egorochkin Date: Mon, 14 Jan 2013 07:37:13 +0200 Subject: [PATCH] Tor: improve circuit isolation. By default apps are isolated better, with extra port available for web browsers to keep performance as it used to be before this commit. --- modules/services/security/tor.nix | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/modules/services/security/tor.nix b/modules/services/security/tor.nix index 41e2b4c356ed..bad6be54e891 100644 --- a/modules/services/security/tor.nix +++ b/modules/services/security/tor.nix @@ -53,6 +53,14 @@ in ''; }; + socksListenAddressFaster = mkOption { + default = "127.0.0.1:9063"; + description = '' + Same as socksListenAddress but uses weaker circuit isolation to provide + performance suitable for a web browser. + ''; + }; + socksPolicy = mkOption { default = ""; example = "accept 192.168.0.0/16, reject *"; @@ -259,7 +267,8 @@ in User ${torUser} '' + optionalString cfg.client.enable '' - SOCKSPort ${cfg.client.socksListenAddress} + SOCKSPort ${cfg.client.socksListenAddress} IsolateDestAddr + SOCKSPort ${cfg.client.socksListenAddressFaster} ${opt "SocksPolicy" cfg.client.socksPolicy} '' + optionalString cfg.relay.enable '' @@ -276,7 +285,7 @@ in # Generally, this file goes in /etc/privoxy/config # # Tor listens as a SOCKS4a proxy here: - forward-socks4a / ${cfg.client.socksListenAddress} . + forward-socks4a / ${cfg.client.socksListenAddressFaster} . confdir ${privoxy}/etc logdir ${privoxyDir} # actionsfile standard # Internal purpose, recommended