Possible Tor - xorg conflict preventing Tor use? Possible compression bomb?

User Support General
1

I can not connect to the TOR Network successfully. I’m running Debian-13-xfce with the Mullvad browser connected to sys-whonix. I have been running this VM for a couple of month with no problem. I was looking at freedesktop’s website and wanted to copy the link to my notes. When I saw the length of the link and forgetting I was connecting to it through TOR, I was thinking it was to show where I had come from. I deleted most of the link so it would only show: www.freedesktop.org . However it would not reload in the browser. I tried to type it in a couple of time and then gave up. Then when I tried to go to any other website it would not load. Also, I went to update a couple of templates and they would not load. Here is the Log:

Updating Debian-13-xfce
 
Refreshing package info
 
Refreshing available packages.

Fail to refresh InRelease: https://deb.debian.org/debian trixie InRelease from https://deb.debian.org/debian/dists/trixie/InRelease

E:Failed to fetch https://deb.debian.org/debian/dists/trixie/InRelease Reading from proxy failed - select (115: Operation now in progress) [IP: 127.0.0.1 8082], E:Failed to fetch

Ign:1 https://deb.debian.org/debian trixie InRelease

Err:1 https://deb.debian.org/debian trixie InRelease

Reading from proxy failed - select (115: Operation now in progress) [IP: 127.0.0.1 8082]

Reading package lists...

E: Failed to fetch https://deb.debian.org/debian/dists/trixie/InRelease Reading from proxy failed - select (115: Operation now in progress) [IP: 127.0.0.1 8082]

E: Some index files failed to download. They have been ignored, or old ones used instead.

Note: there were 5 repositories but they all said the same thing. I’m only showing the fist one to make it easier to read it. The Xsessions Error Log showed this:

X.Org X Server 1.21.1.16

X Protocol Version 11, Revision 0

Current Operating System: Linux joe-mandalore 6.12.64-1.qubes.fc41.x86_64 #1 SMP PREEMPT_DYNAMIC Sat Jan 10 21:51:22 UTC 2026 x86_64

Kernel command line: systemd.machine_id=1003f744e22c4388b9165b52ddbabe05 root=/dev/mapper/dmroot ro nomodeset console=hvc0 rd_NO_PLYMOUTH rd.plymouth.enable=0 plymouth.enable=0 clocksource=tsc xen_scrub_pages=0 swiotlb=2048 apparmor=1 security=apparmor

xorg-server 2:21.1.16-1.3+deb13u1 (https://www.debian.org/support)

Current version of pixman: 0.44.0

Before reporting problems, check http://wiki.x.org

to make sure that you have the latest version.

Markers: (--) probed, (**) from config file, (==) default setting,

(++) from command line, (!!) notice, (II) informational,

(WW) warning, (EE) error, (NI) not implemented, (??) unknown.

(==) Log file: "/home/user/.local/share/xorg/Xorg.0.log", Time: Thu Feb 19 19:44:58 2026

(++) Using config file: "/etc/X11/xorg-qubes.conf"

(==) Using system config directory "/usr/share/X11/xorg.conf.d"

Xsession: X session started for user at Thu Feb 19 07:44:58 PM EST 2026

dbus-update-activation-environment: setting DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus

dbus-update-activation-environment: setting DISPLAY=:0

dbus-update-activation-environment: setting XDG_CURRENT_DESKTOP=X-QUBES

xsettingsd: Loaded 18 settings from /home/user/.xsettingsd

xsettingsd: Created window 0x200001 on screen 0 with timestamp 4298

xsettingsd: Selection _XSETTINGS_S0 is owned by 0x0

xsettingsd: Took ownership of selection _XSETTINGS_S0

localuser:user being added to access control list

Failed to read /guivm-windows-prefix

dbus-update-activation-environment: setting QT_ACCESSIBILITY=1

xsettingsd: 0x200001 took a selection from us; exiting

Failed to process 'org.kde.kalendarac.desktop': constructor returned NULL

** (xiccd:1057): CRITICAL **: 19:44:59.310: Failed to connect to colord: Error calling StartServiceByName for org.freedesktop.ColorManager: Unit colord.service is masked.

** (light-locker:1051): ERROR **: 19:44:59.311: Environment variable XDG_SESSION_PATH not set. Is LightDM running?

discover_other_daemon: 1GNOME_KEYRING_CONTROL=/run/user/1000/keyring

SSH_AUTH_SOCK=/run/user/1000/keyring/ssh

discover_other_daemon: 1GNOME_KEYRING_CONTROL=/run/user/1000/keyring

SSH_AUTH_SOCK=/run/user/1000/keyring/ssh

discover_other_daemon: 1GNOME_KEYRING_CONTROL=/run/user/1000/keyring

SSH_AUTH_SOCK=/run/user/1000/keyring/ssh

Not in GuiVM or dom0. Exiting.

2026-02-19 19:44:59.423 qrexec-fork-server[1122]: qrexec-agent-data.c:184:handle_just_exec: executed (nowait): /etc/qubes-rpc/qubes.StartApp qubes.StartApp+xfce4-file-manager dom0 (pid 1125)

(polkit-mate-authentication-agent-1:1087): GLib-CRITICAL **: 19:44:59.427: g_variant_new_string: assertion 'string != NULL' failed

(polkit-mate-authentication-agent-1:1087): polkit-mate-1-WARNING **: 19:44:59.431: Failed to register client: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.gnome.SessionManager was not provided by any .service files

(xfsettingsd:984): xfsettingsd-WARNING **: 19:44:59.549: Failed to connect to session manager: Failed to connect to the session manager: SESSION_MANAGER environment variable not defined

2026-02-19 19:44:59,570 icon-sender: running: ['qrexec-client-vm', 'dom0', 'qubes.WindowIconUpdater']

Another notification daemon is running, exiting

Xlib: extension "DPMS" missing on display ":0".

xfsettingsd: No window manager registered on screen 0.

(xfsettingsd:984): xfsettingsd-WARNING **: 19:45:05.304: Failed to get the _NET_NUMBER_OF_DESKTOPS property.

2026-02-19 20:06:45.444 qrexec-fork-server[1335]: qrexec-agent-data.c:274:handle_new_process_common: executed: QUBESRPC qubes.WaitForSession+ dom0 (pid 1337)

2026-02-19 20:06:45.458 qrexec-fork-server[1335]: qrexec-agent-data.c:309:handle_new_process_common: pid 1337 exited with 0

2026-02-19 20:06:45.480 qrexec-fork-server[1349]: qrexec-agent-data.c:184:handle_just_exec: executed (nowait): /etc/qubes-rpc/qubes.StartApp qubes.StartApp+mullvad-browser dom0 (pid 1351)

2026-02-19 20:09:00.119 qrexec-fork-server[1724]: qrexec-agent-data.c:274:handle_new_process_common: executed: QUBESRPC qubes.WaitForSession+ dom0 (pid 1726)

2026-02-19 20:09:00.127 qrexec-fork-server[1724]: qrexec-agent-data.c:309:handle_new_process_common: pid 1726 exited with 0

When I went into the sys-whonix control panel I found this in the Tor Log:

Feb 20 01:06... [notice] Application request when we haven't used client functionality lately. Optimistically trying directory fetches again.

Feb 20 01:06... [warn] Detected possible compression bomb with input size = 15398 and output size = 420264 (compression factor = 27.29)

Feb 20 01:06... [warn] Possible compression bomb; abandoning stream.

Feb 20 01:06... [warn] Detected possible compression bomb with input size = 17208 and output size = 452828 (compression factor = 26.31)

Feb 20 01:06... [warn] Possible compression bomb; abandoning stream.

Feb 20 01:06... [notice] Application request when we haven't used client functionality lately. Optimistically trying directory fetches again.

Feb 20 01:06... [warn] Detected possible compression bomb with input size = 15398 and output size = 420264 (compression factor = 27.29)

Feb 20 01:06... [warn] Possible compression bomb; abandoning stream.

Feb 20 01:06... [warn] Detected possible compression bomb with input size = 17208 and output size = 452828 (compression factor = 26.31)

Feb 20 01:06... [warn] Possible compression bomb; abandoning stream.

Feb 20 01:07... [notice] Application request when we haven't used client functionality lately. Optimistically trying directory fetches again.

Feb 20 01:07... [warn] Detected possible compression bomb with input size = 17208 and output size = 452828 (compression factor = 26.31)

Feb 20 01:07... [warn] Possible compression bomb; abandoning stream.

Feb 20 01:07... [warn] Detected possible compression bomb with input size = 15398 and output size = 420264 (compression factor = 27.29)

Feb 20 01:07... [warn] Possible compression bomb; abandoning stream.

In the system Journal this is what it said:

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening Socks listener on 10.137.0.9:9189

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened Socks listener connection (ready) on 10.137.0.9:9189

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening DNS listener on 127.0.0.1:5400

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened DNS listener connection (ready) on 127.0.0.1:5400

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening DNS listener on 10.137.0.9:5300

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened DNS listener connection (ready) on 10.137.0.9:5300

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening Transparent pf/netfilter listener on 127.0.0.1:9041

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened Transparent pf/netfilter listener connection (ready) on 127.0.0.1:9041

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening Transparent pf/netfilter listener on 10.137.0.9:9040

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened Transparent pf/netfilter listener connection (ready) on 10.137.0.9:9040

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening HTTP tunnel listener on 127.0.0.1:9190

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened HTTP tunnel listener connection (ready) on 127.0.0.1:9190

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening HTTP tunnel listener on 127.0.0.1:9191

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened HTTP tunnel listener connection (ready) on 127.0.0.1:9191

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening HTTP tunnel listener on 127.0.0.1:9192

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened HTTP tunnel listener connection (ready) on 127.0.0.1:9192

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening HTTP tunnel listener on 127.0.0.1:9193

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened HTTP tunnel listener connection (ready) on 127.0.0.1:9193

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening HTTP tunnel listener on 10.137.0.9:9229

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened HTTP tunnel listener connection (ready) on 10.137.0.9:9229

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening Control listener on 127.0.0.1:9052

Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened Control listener connection (ready) on 127.0.0.1:9052

Feb 19 20:23:00 host systemd[1]: Started tor@default.service - Anonymizing overlay network for TCP.

In the Torrc files it said this:

# Do not edit this file!

# Please create and add modifications to the following file instead:

# /usr/local/etc/torrc.d/50_user.conf

The whole “Detected possible compression bomb” has me a little worried. So what does everyone think? Was I hacked, attacked, or did I screw up?

2 Likes
2

Looks to me that www.freedesktop.org has some “go-away” protection that may trigger weirdly when you access the site via Tor.
Assuming you attempted the template updates trough the same sys-whonix that threw the “possible compression bomb” warnings … I’d restart that sys-whonix and get on. Maybe restart the whole computer.

EDIT: and YES, in true MS Windows-style! :laughing:

3 Likes
3

May i ask why you just don’t use whonix ?

2 Likes
4

go-away is an anti-AI scrapping software solution:

It is less adopted compared to Anubis.

2 Likes
5

Hi guys, thanks for the impute. barto I did turn the whole system off and on again a couple of times to no avail. It must have been set up for a certain length of time. I didn’t think to try turning sys-whonix off and on though. dkzkz I have several normal programs that I use in one of my qubes that I want some anonymity in but not worried enough to make another whonix qube with all of them in. FrankyFlawless nice link. That explains a bit. I called Fios last night before I posted thinking it was them not liking my using tor and they did get it to work again, but about 10 minutes after the call ended it started up again. That when I started looking at any and all logs that might have something to say. This morning I started up the computer and it’s fine now. No problems all day. Thanks for the help everyone.

3 Likes
6

This is a Whonix thing not a Tor thing.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

3 Likes