- tor-relays - lists.torproject.org

problem with new obfs4 bridge
by Christopher Sheats 26 Mar '21

26 Mar '21

Hello, We’re trying to get a 10GbE dual-stack public obfs4 bridge online, but presumably having some trouble with obfs4. I wished to open a bug, but my request for an account via https://gitlab.onionize.space/ is not being approved. These two recent tickets appear to be related: https://gitlab.torproject.org/tpo/core/tor/-/issues/40311 https://gitlab.torproject.org/tpo/core/tor/-/issues/40107 Ubuntu Server 20.10 tor 0.4.5.7 obfs4proxy 0.8 Firewall accepts TCP/UDP 80/443. Metrics link: https://metrics.torproject.org/rs.html#details/7ADC8C6BF93197830FDF3E06DFB4… torrc: BridgeRelay 1 ORPort 80 ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy ServerTransportListenAddr obfs4 0.0.0.0:443 ExtORPort auto ContactInfo tech(a)emeraldonion.org Nickname EmeraldOnionBridge1 MaxMemInQueues 8192MB Log notice file /var/log/tor/notices.log Log notice syslog Tor Browser connect errors: “obfs4 [2620:18c:0:192::194]:443 7ADC8C6BF93197830FDF3E06DFB4D96E7CFEDCF3” 3/26/21, 18:46:55.269 [WARN] Proxy Client: unable to connect OR connection (handshaking (proxy)) with [2620:18c:0:192::194]:443 ID=H50HNwR2NkpCR9QPST8MdPfmTC43YyZ7sswt9yDTJGA RSA_ID=7ADC8C6BF93197830FDF3E06DFB4D96E7CFEDCF3 ("general SOCKS server failure") “obfs4 [2620:18c:0:192::194]:443” 3/26/21, 18:47:33.467 [WARN] Proxy Client: unable to connect OR connection (handshaking (proxy)) with [scrubbed] ("general SOCKS server failure") “[2620:18c:0:192::194]” 3/26/21, 19:03:52.905 [WARN] Problem bootstrapping. Stuck at 10% (conn_done): Connected to a relay. (TLS_ERROR; TLS_ERROR; count 2; recommendation warn; host 7ADC8C6BF93197830FDF3E06DFB4D96E7CFEDCF3 at 2620:18c:0:192::194:443) 3/26/21, 19:03:52.905 [WARN] 2 connections have failed: 3/26/21, 19:03:52.905 [WARN] 2 connections died in state handshaking (TLS) with SSL state SSLv3/TLS write client hello in HANDSHAKE “23.129.64.194” 3/26/21, 19:06:43.811 [WARN] Problem bootstrapping. Stuck at 10% (conn_done): Connected to a relay. (DONE; DONE; count 3; recommendation warn; host 0000000000000000000000000000000000000000 at 23.129.64.194:443) 3/26/21, 19:06:43.811 [WARN] 3 connections have failed: 3/26/21, 19:06:43.811 [WARN] 3 connections died in state handshaking (TLS) with SSL state SSLv3/TLS write client hello in HANDSHAKE No issues: “[2620:18c:0:192::194]:80 7ADC8C6BF93197830FDF3E06DFB4D96E7CFEDCF3” “23.129.64.194:80 7ADC8C6BF93197830FDF3E06DFB4D96E7CFEDCF3” Notices log output: Mar 26 11:38:29.000 [notice] Tor 0.4.5.7 opening log file. Mar 26 11:38:29.600 [notice] We compiled with OpenSSL 1010106f: OpenSSL 1.1.1f 31 Mar 2020 and we are running with OpenSSL 1010106f: 1.1.1f. These two versions should be binary compatible. Mar 26 11:38:29.601 [notice] Tor 0.4.5.7 running on Linux with Libevent 2.1.12-stable, OpenSSL 1.1.1f, Zlib 1.2.11, Liblzma 5.2.4, Libzstd 1.4.5 and Glibc 2.32 as libc. Mar 26 11:38:29.601 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning Mar 26 11:38:29.601 [notice] Read configuration file "/usr/share/tor/tor-service-defaults-torrc". Mar 26 11:38:29.601 [notice] Read configuration file "/etc/tor/torrc". Mar 26 11:38:29.603 [notice] Opening Socks listener on 127.0.0.1:9050 Mar 26 11:38:29.603 [notice] Opened Socks listener connection (ready) on 127.0.0.1:9050 Mar 26 11:38:29.603 [notice] Opening OR listener on 0.0.0.0:80 Mar 26 11:38:29.603 [notice] Opened OR listener connection (ready) on 0.0.0.0:80 Mar 26 11:38:29.603 [notice] Opening OR listener on [::]:80 Mar 26 11:38:29.603 [notice] Opened OR listener connection (ready) on [::]:80 Mar 26 11:38:29.603 [notice] Opening Extended OR listener on 127.0.0.1:0 Mar 26 11:38:29.603 [notice] Extended OR listener listening on port 40739. Mar 26 11:38:29.603 [notice] Opened Extended OR listener connection (ready) on 127.0.0.1:40739 Mar 26 11:38:30.000 [notice] Parsing GEOIP IPv4 file /usr/share/tor/geoip. Mar 26 11:38:30.000 [notice] Parsing GEOIP IPv6 file /usr/share/tor/geoip6. Mar 26 11:38:30.000 [notice] Configured to measure statistics. Look for the *-stats files that will first be written to the data directory in 24 hours from now. Mar 26 11:38:30.000 [notice] Your Tor server's identity key fingerprint is 'EmeraldOnionBridge1 7ADC8C6BF93197830FDF3E06DFB4D96E7CFEDCF3' Mar 26 11:38:30.000 [notice] Your Tor bridge's hashed identity key fingerprint is 'EmeraldOnionBridge1 09E23FA5AD9CF64DBEFE88A39A2F1EB215E44B53' Mar 26 11:38:30.000 [notice] Your Tor server's identity key ed25519 fingerprint is 'EmeraldOnionBridge1 H50HNwR2NkpCR9QPST8MdPfmTC43YyZ7sswt9yDTJGA' Mar 26 11:38:30.000 [notice] Bootstrapped 0% (starting): Starting Mar 26 11:38:36.000 [notice] Starting with guard context "default" Mar 26 11:38:36.000 [notice] Signaled readiness to systemd Mar 26 11:38:36.000 [notice] Registered server transport 'obfs4' at '[::]:443' Mar 26 11:38:37.000 [notice] Bootstrapped 5% (conn): Connecting to a relay Mar 26 11:38:37.000 [notice] Opening Socks listener on /run/tor/socks Mar 26 11:38:37.000 [notice] Opened Socks listener connection (ready) on /run/tor/socks Mar 26 11:38:37.000 [notice] Opening Control listener on /run/tor/control Mar 26 11:38:37.000 [notice] Opened Control listener connection (ready) on /run/tor/control Mar 26 11:38:37.000 [notice] Bootstrapped 10% (conn_done): Connected to a relay Mar 26 11:38:37.000 [notice] Bootstrapped 14% (handshake): Handshaking with a relay Mar 26 11:38:37.000 [notice] Bootstrapped 15% (handshake_done): Handshake with a relay done Mar 26 11:38:37.000 [notice] Bootstrapped 75% (enough_dirinfo): Loaded enough directory info to build circuits Mar 26 11:38:37.000 [notice] Bootstrapped 90% (ap_handshake_done): Handshake finished with a relay to build circuits Mar 26 11:38:37.000 [notice] Bootstrapped 95% (circuit_create): Establishing a Tor circuit Mar 26 11:38:38.000 [notice] Bootstrapped 100% (done): Done Mar 26 11:38:38.000 [notice] Now checking whether IPv4 ORPort 23.129.64.194:80 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) Mar 26 11:38:38.000 [notice] Now checking whether IPv6 ORPort [2620:18c:0:192::194]:80 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) Mar 26 11:38:39.000 [notice] Self-testing indicates your ORPort [2620:18c:0:192::194]:80 is reachable from the outside. Excellent. Mar 26 11:38:39.000 [notice] Self-testing indicates your ORPort 23.129.64.194:80 is reachable from the outside. Excellent. Publishing server descriptor. Mar 26 11:40:32.000 [notice] Performing bandwidth self-test...done. A prior torrc config set the IPs explicitly, but had the same result: ServerTransportListenAddr obfs4 23.129.64.194:443 ServerTransportListenAddr obfs4 [2620:18c:0:192::194]:443 I can provide debug logs as necessary. Possibly of note, our firewall does not use connection tracking and applies the same rules as our exit relays which use the same ports. Pro-active note: The bridge shares the same 23.129.64.0/24 subnet as Emerald Onion's Tor exit relays, so there is no risk of a user entering and exiting our physical network (see "2.2. Path selection and constraints"): https://github.com/torproject/torspec/blob/master/path-spec.txt Cheers, -- Christopher Sheats Executive Director for Emerald Onion Email: yawnbox(a)emeraldonion.org Phone: +1 206-739-3390 Web: https://emeraldonion.org/

1 0

Tor project helping to attempt to cancel Richard Stallman
by Jeffrey Cliff 26 Mar '21

26 Mar '21

I've been running a relay/exit node for many years. Tor user since ~2004. To the extent that my voice means anything at all here, I would like to strongly condemn the Tor project joining the attempt to cancel Richard Stallman. Stallman represents software freedom to me generally and as of today I will be shutting down my exit node in protest of this action by the Tor Project. I hope the rest of you out there, who depend every day on GNU project code which would not exist without RMS's project, might consider joining me. Jeff Cliff former tor exit node admin

19 25

Active MetricsPort logs "Address already in use"
by Alexander Dietrich 25 Mar '21

25 Mar '21

Hello, when I activate the "MetricsPort" feature, the Tor log reports that it is going to open the port, then it says "Address already in use". According to "netstat", the address is indeed in use, but by "tor". Sending GET requests to the address returns empty responses. Any ideas? Kind regards, Alexander -- PGP Key: https://dietrich.cx/pgp | 0x52FA4EE1722D54EB

2 4

Tor 0.4.5.6 and missing IPv6
by Marco Predicatori 25 Mar '21

25 Mar '21

Hi, I've recently upgraded to Tor 0.4.5.6. Everything seems to work fine, but in the notices_log file I have a lot of these lines: [notice] Unable to find IPv6 address for ORPort 9001. You might want to specify IPv6Only to it or set an explicit address or set Address. I don't have IPv6, and any line mentioning IPv6 in the torrc file is commented. Is there anythng I need to do in order to get rid of those notices, or can I just let them be? Thanks, Marco -- https://metrics.torproject.org/rs.html#details/A4E74410D83705EEFF24BC265DE2…

4 10

Security advisory: Please upgrade to today's OpenSSL.
by Nick Mathewson 25 Mar '21

25 Mar '21

Hi, all! There is a new version of OpenSSL out today, with a security advisory that affects Tor. The vulnerability is CVE-2021-3449, as described on https://www.openssl.org/news/secadv/20210325.txt . It affects OpenSSL versions 1.1.1 through 1.1.1j. OpenSSL 1.1.1k is the first version with a fix. I haven't tested this bug, but I believe that it would allow an adversary to remotely crash Tor relays and authorities. It won't have any effect on Tor clients. I suggest that everybody should upgrade to the latest OpenSSL when it becomes available on their platform. best wishes, -- Nick

1 0

Failed upgrade
by r1610091651 24 Mar '21

24 Mar '21

Hi FYI So I've upgraded tor package from 0.4.4.6 to 0.4.5.7-1~xenial+1. No other changes. Yet on startup tor is complaining about mis-configuration: Mar 23 20:55:02.928 [notice] Read configuration file "/usr/share/tor/tor-service-defaults-torrc". Mar 23 20:55:02.929 [notice] Read configuration file "/etc/tor/torrc". Mar 23 20:55:02.932 [warn] Configuration port ORPort 9443 superseded by ORPort <local-ip>:9443 Mar 23 20:55:02.932 [warn] We are listening on an ORPort, but not advertising any ORPorts. This will keep us from building a router descriptor, and make us impossible to use. Mar 23 20:55:02.932 [warn] Failed to parse/validate config: Misconfigured server ports Mar 23 20:55:02.932 [err] Reading config failed--see warnings above. config: ORPort <local-ip>:9443 NoAdvertise ORPort 9443 NoListen IPv4Only AddressDisableIPv6 1 OutboundBindAddress <local-ip> This config is according to spec and worked with 4.4.6. Seems to be related to thes issues, except for me it's blocking: tor fails to start. https://gitlab.torproject.org/tpo/core/tor/-/issues/40300 https://gitlab.torproject.org/tpo/core/tor/-/issues/40302 I had to add 0.0.0.0 as ip to make tor start, although that's not documented... ORPort <local-ip>:9443 NoAdvertise ORPort 0.0.0.0:9443 NoListen IPv4Only Regards

2 1

is this valid bridge config
by gi vian 23 Mar '21

23 Mar '21

hello, i want to run bridge. i have configured using tor relay configurator(1). is this valid or can it be improved. config ------ ORPort auto SocksPort 0 BridgeRelay 1 ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy ServerTransportListenAddr obfs4 0.0.0.0:8042 ExtOrPort auto Log notice file /var/log/tor/notices.log ExitPolicy reject *:* ------ regards, vian (1) https://tor-relay.co/

2 1

Circuit Creation Madness: Anyone else still experiencing (extremely) excessive clients / (possibly) modified relays creating millions upon millions of circuits?
by William Kane 23 Mar '21

23 Mar '21

@tor-relays: Sorry for being quite noisy recently but I really need to know how many people are suffering from the same madness I am encountering right now. Quick excerpt from the log: ... Mar 22 09:48:10 <hostname_redacted> tor[pid_redacted]: Mar 22 09:48:10.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [12420 similar message(s) suppressed in last 120 seconds] Mar 22 09:49:10 <hostname_redacted> tor[pid_redacted]: Mar 22 09:49:10.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [31764 similar message(s) suppressed in last 60 seconds] Mar 22 09:50:10 <hostname_redacted> tor[pid_redacted]: Mar 22 09:50:10.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [104748 similar message(s) suppressed in last 60 seconds] Mar 22 09:51:10 <hostname_redacted> tor[pid_redacted]: Mar 22 09:51:10.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [364165 similar message(s) suppressed in last 60 seconds] Mar 22 09:52:10 <hostname_redacted> tor[pid_redacted]: Mar 22 09:52:10.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [509474 similar message(s) suppressed in last 60 seconds] Mar 22 09:53:10 <hostname_redacted> tor[pid_redacted]: Mar 22 09:53:10.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [241332 similar message(s) suppressed in last 60 seconds] ... This then goes on for a while, stopping at a few million suppressed messages / circuit creation attempts. Sorry, but 1 million circuit creation requests in just 5 minutes, there is no way that this is legitimate behavior we are seeing - this is also what was previously used to get my relay oom-killed but that I have fixed so the legitimate clients hopefully don't suffer too much anymore. If any other relay operators are encountering the same log entries or behavior, please don't hesitate to reply. Added tor-dev(a)lists.torproject.org as a CC as they might want to know about this. @tor-dev: I suspect some kind of denial-of-service attack against onion services or a more targeted attack against singular relays for guard discovery / traffic confirmation attacks. Might be smart to add some code which, if this scenario is triggered, lists offenders by hashes of their signing keys (if relay), or IP addresses (if client). There doesn't seem to be a defense against this, and the new connect() rate-limit added through ticket 40253 also won't handle this as the connection is already ACK'd and established, and a malicious relay with custom source code could do whatever it was programmed to do anyway. - William

2 2

ECONNREFUSED
by tor 23 Mar '21

23 Mar '21

Hi All, I've been running a bridge on my home lan. I'm able to successfully attach to the bridge on the lan and from the wan. There are established circuits and clients: https://metrics.torproject.org/rs.html#details/E120A0492F789F5367EAD84C64F9… According to the tcp reachablilty test everything is reachable. However, the status page keeps saying I'm dysfunctional with a ECONNREFUSED: https://bridges.torproject.org/status?id=E120A0492F789F5367EAD84C64F92EE279… So everything seems to be working on my end. -matt

3 2

Question
by Андрей Гвоздев 23 Mar '21

23 Mar '21

What does it mean "Tor's file descriptor usage is at 90%. If you run out Tor will be unable to continue functioning."?

2 1