This repository documents bugs found in the Tails onion-grater Tor control
port filter, to be reported upstream to Tails.
onion-grater originated in Tails; Whonix maintains a fork. These issues were
found during a 2026-06 resync of the Whonix fork to the current Tails version,
in an AI-assisted code review pass (Codex + CodeRabbit). They are pre-existing
in Tails upstream -- present in the Tails master version and inherited by the
Whonix fork; none was introduced by the resync.
- Project: Tails (
tails/tails) - Source file:
config/chroot_local-includes/usr/local/lib/onion-grater - Blob: https://gitlab.tails.boum.org/tails/tails/-/blob/master/config/chroot_local-includes/usr/local/lib/onion-grater
- Issues: https://gitlab.tails.boum.org/tails/tails/-/issues
- Line numbers below refer to the Tails
masterversion at the time of writing (script header#!/usr/bin/python3 -Iu). Functions are cited too, since line numbers drift.
| # | Severity | Bug | Triggers when |
|---|---|---|---|
| 01 | major | tor-browser-mode drops all STREAM events on PID-based (loopback) connections |
a loopback client uses a tor-browser-mode profile |
| 02 | major | --complain still runs argument/response/event rewriters |
--complain used on a profile with rewrite rules |
| 03 | major | crash building the "multiple filters matched" error (joins dicts) | two profiles match one client |
| 04 | major | empty profile file crashes startup (yaml.safe_load returns None) |
an empty .yml exists in the drop-in dir |
| 05 | minor | rewrite-logging debug flags inverted (command vs response direction) | --debug / --complain rewrite logging |
| 06 | major | busy-loop CPU DoS on a stalled / oversize request line (measured ~98% of a core per connection) | a client sends a partial line and stalls |
Most of these do not affect the Whonix fork in normal operation:
- #01 is inert in Whonix: no Whonix profile enables
tor-browser-mode. (It does, however, block enabling per-app stream isolation for a loopback-matched app such as wahay -- see the bug for details.) - #02 and #05 affect only debug/diagnostic modes.
- #03 and #04 are real crashes, but only on a misconfiguration (two matching profiles) or an empty profile file respectively.
- #06 does affect Whonix: the untrusted Workstation can pin the Gateway's CPU cores with a few connections, each sending one incomplete line. It is a CPU denial of service (not a deanonymization / control bypass), and was empirically confirmed.
How each is handled in the Whonix fork (fix locally vs. wait for upstream) is a separate decision; this repo only documents the upstream defects.