I can not connect to the TOR Network successfully. I’m running Debian-13-xfce with the Mullvad browser connected to sys-whonix. I have been running this VM for a couple of month with no problem. I was looking at freedesktop’s website and wanted to copy the link to my notes. When I saw the length of the link and forgetting I was connecting to it through TOR, I was thinking it was to show where I had come from. I deleted most of the link so it would only show: www.freedesktop.org . However it would not reload in the browser. I tried to type it in a couple of time and then gave up. Then when I tried to go to any other website it would not load. Also, I went to update a couple of templates and they would not load. Here is the Log:
Updating Debian-13-xfce
Refreshing package info
Refreshing available packages.
Fail to refresh InRelease: https://deb.debian.org/debian trixie InRelease from https://deb.debian.org/debian/dists/trixie/InRelease
E:Failed to fetch https://deb.debian.org/debian/dists/trixie/InRelease Reading from proxy failed - select (115: Operation now in progress) [IP: 127.0.0.1 8082], E:Failed to fetch
Ign:1 https://deb.debian.org/debian trixie InRelease
Err:1 https://deb.debian.org/debian trixie InRelease
Reading from proxy failed - select (115: Operation now in progress) [IP: 127.0.0.1 8082]
Reading package lists...
E: Failed to fetch https://deb.debian.org/debian/dists/trixie/InRelease Reading from proxy failed - select (115: Operation now in progress) [IP: 127.0.0.1 8082]
E: Some index files failed to download. They have been ignored, or old ones used instead.
Note: there were 5 repositories but they all said the same thing. I’m only showing the fist one to make it easier to read it. The Xsessions Error Log showed this:
X.Org X Server 1.21.1.16
X Protocol Version 11, Revision 0
Current Operating System: Linux joe-mandalore 6.12.64-1.qubes.fc41.x86_64 #1 SMP PREEMPT_DYNAMIC Sat Jan 10 21:51:22 UTC 2026 x86_64
Kernel command line: systemd.machine_id=1003f744e22c4388b9165b52ddbabe05 root=/dev/mapper/dmroot ro nomodeset console=hvc0 rd_NO_PLYMOUTH rd.plymouth.enable=0 plymouth.enable=0 clocksource=tsc xen_scrub_pages=0 swiotlb=2048 apparmor=1 security=apparmor
xorg-server 2:21.1.16-1.3+deb13u1 (https://www.debian.org/support)
Current version of pixman: 0.44.0
Before reporting problems, check http://wiki.x.org
to make sure that you have the latest version.
Markers: (--) probed, (**) from config file, (==) default setting,
(++) from command line, (!!) notice, (II) informational,
(WW) warning, (EE) error, (NI) not implemented, (??) unknown.
(==) Log file: "/home/user/.local/share/xorg/Xorg.0.log", Time: Thu Feb 19 19:44:58 2026
(++) Using config file: "/etc/X11/xorg-qubes.conf"
(==) Using system config directory "/usr/share/X11/xorg.conf.d"
Xsession: X session started for user at Thu Feb 19 07:44:58 PM EST 2026
dbus-update-activation-environment: setting DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
dbus-update-activation-environment: setting DISPLAY=:0
dbus-update-activation-environment: setting XDG_CURRENT_DESKTOP=X-QUBES
xsettingsd: Loaded 18 settings from /home/user/.xsettingsd
xsettingsd: Created window 0x200001 on screen 0 with timestamp 4298
xsettingsd: Selection _XSETTINGS_S0 is owned by 0x0
xsettingsd: Took ownership of selection _XSETTINGS_S0
localuser:user being added to access control list
Failed to read /guivm-windows-prefix
dbus-update-activation-environment: setting QT_ACCESSIBILITY=1
xsettingsd: 0x200001 took a selection from us; exiting
Failed to process 'org.kde.kalendarac.desktop': constructor returned NULL
** (xiccd:1057): CRITICAL **: 19:44:59.310: Failed to connect to colord: Error calling StartServiceByName for org.freedesktop.ColorManager: Unit colord.service is masked.
** (light-locker:1051): ERROR **: 19:44:59.311: Environment variable XDG_SESSION_PATH not set. Is LightDM running?
discover_other_daemon: 1GNOME_KEYRING_CONTROL=/run/user/1000/keyring
SSH_AUTH_SOCK=/run/user/1000/keyring/ssh
discover_other_daemon: 1GNOME_KEYRING_CONTROL=/run/user/1000/keyring
SSH_AUTH_SOCK=/run/user/1000/keyring/ssh
discover_other_daemon: 1GNOME_KEYRING_CONTROL=/run/user/1000/keyring
SSH_AUTH_SOCK=/run/user/1000/keyring/ssh
Not in GuiVM or dom0. Exiting.
2026-02-19 19:44:59.423 qrexec-fork-server[1122]: qrexec-agent-data.c:184:handle_just_exec: executed (nowait): /etc/qubes-rpc/qubes.StartApp qubes.StartApp+xfce4-file-manager dom0 (pid 1125)
(polkit-mate-authentication-agent-1:1087): GLib-CRITICAL **: 19:44:59.427: g_variant_new_string: assertion 'string != NULL' failed
(polkit-mate-authentication-agent-1:1087): polkit-mate-1-WARNING **: 19:44:59.431: Failed to register client: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.gnome.SessionManager was not provided by any .service files
(xfsettingsd:984): xfsettingsd-WARNING **: 19:44:59.549: Failed to connect to session manager: Failed to connect to the session manager: SESSION_MANAGER environment variable not defined
2026-02-19 19:44:59,570 icon-sender: running: ['qrexec-client-vm', 'dom0', 'qubes.WindowIconUpdater']
Another notification daemon is running, exiting
Xlib: extension "DPMS" missing on display ":0".
xfsettingsd: No window manager registered on screen 0.
(xfsettingsd:984): xfsettingsd-WARNING **: 19:45:05.304: Failed to get the _NET_NUMBER_OF_DESKTOPS property.
2026-02-19 20:06:45.444 qrexec-fork-server[1335]: qrexec-agent-data.c:274:handle_new_process_common: executed: QUBESRPC qubes.WaitForSession+ dom0 (pid 1337)
2026-02-19 20:06:45.458 qrexec-fork-server[1335]: qrexec-agent-data.c:309:handle_new_process_common: pid 1337 exited with 0
2026-02-19 20:06:45.480 qrexec-fork-server[1349]: qrexec-agent-data.c:184:handle_just_exec: executed (nowait): /etc/qubes-rpc/qubes.StartApp qubes.StartApp+mullvad-browser dom0 (pid 1351)
2026-02-19 20:09:00.119 qrexec-fork-server[1724]: qrexec-agent-data.c:274:handle_new_process_common: executed: QUBESRPC qubes.WaitForSession+ dom0 (pid 1726)
2026-02-19 20:09:00.127 qrexec-fork-server[1724]: qrexec-agent-data.c:309:handle_new_process_common: pid 1726 exited with 0
When I went into the sys-whonix control panel I found this in the Tor Log:
Feb 20 01:06... [notice] Application request when we haven't used client functionality lately. Optimistically trying directory fetches again.
Feb 20 01:06... [warn] Detected possible compression bomb with input size = 15398 and output size = 420264 (compression factor = 27.29)
Feb 20 01:06... [warn] Possible compression bomb; abandoning stream.
Feb 20 01:06... [warn] Detected possible compression bomb with input size = 17208 and output size = 452828 (compression factor = 26.31)
Feb 20 01:06... [warn] Possible compression bomb; abandoning stream.
Feb 20 01:06... [notice] Application request when we haven't used client functionality lately. Optimistically trying directory fetches again.
Feb 20 01:06... [warn] Detected possible compression bomb with input size = 15398 and output size = 420264 (compression factor = 27.29)
Feb 20 01:06... [warn] Possible compression bomb; abandoning stream.
Feb 20 01:06... [warn] Detected possible compression bomb with input size = 17208 and output size = 452828 (compression factor = 26.31)
Feb 20 01:06... [warn] Possible compression bomb; abandoning stream.
Feb 20 01:07... [notice] Application request when we haven't used client functionality lately. Optimistically trying directory fetches again.
Feb 20 01:07... [warn] Detected possible compression bomb with input size = 17208 and output size = 452828 (compression factor = 26.31)
Feb 20 01:07... [warn] Possible compression bomb; abandoning stream.
Feb 20 01:07... [warn] Detected possible compression bomb with input size = 15398 and output size = 420264 (compression factor = 27.29)
Feb 20 01:07... [warn] Possible compression bomb; abandoning stream.
In the system Journal this is what it said:
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening Socks listener on 10.137.0.9:9189
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened Socks listener connection (ready) on 10.137.0.9:9189
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening DNS listener on 127.0.0.1:5400
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened DNS listener connection (ready) on 127.0.0.1:5400
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening DNS listener on 10.137.0.9:5300
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened DNS listener connection (ready) on 10.137.0.9:5300
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening Transparent pf/netfilter listener on 127.0.0.1:9041
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened Transparent pf/netfilter listener connection (ready) on 127.0.0.1:9041
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening Transparent pf/netfilter listener on 10.137.0.9:9040
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened Transparent pf/netfilter listener connection (ready) on 10.137.0.9:9040
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening HTTP tunnel listener on 127.0.0.1:9190
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened HTTP tunnel listener connection (ready) on 127.0.0.1:9190
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening HTTP tunnel listener on 127.0.0.1:9191
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened HTTP tunnel listener connection (ready) on 127.0.0.1:9191
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening HTTP tunnel listener on 127.0.0.1:9192
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened HTTP tunnel listener connection (ready) on 127.0.0.1:9192
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening HTTP tunnel listener on 127.0.0.1:9193
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened HTTP tunnel listener connection (ready) on 127.0.0.1:9193
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening HTTP tunnel listener on 10.137.0.9:9229
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened HTTP tunnel listener connection (ready) on 10.137.0.9:9229
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opening Control listener on 127.0.0.1:9052
Feb 19 20:22:59 host tor[2851]: Feb 19 20:22:59.899 [notice] Opened Control listener connection (ready) on 127.0.0.1:9052
Feb 19 20:23:00 host systemd[1]: Started tor@default.service - Anonymizing overlay network for TCP.
In the Torrc files it said this:
# Do not edit this file!
# Please create and add modifications to the following file instead:
# /usr/local/etc/torrc.d/50_user.conf
The whole “Detected possible compression bomb” has me a little worried. So what does everyone think? Was I hacked, attacked, or did I screw up?
