Am 09.02.2018 um 19:28 schrieb niftybunny:

reject 80

Thats why.

Was there a change of rules on that day? Reject 80 was always the case in those settings.

...

On 9. Feb 2018, at 19:25, nusenu <nusenu-lists@riseup.net> wrote:

Paul:

...

What could bring several exits at different providers and different operating systems (Linux and FreeBSD) down on the same day, Jan 21st?

Since, while they still run as relays, they don’t show as exits any more without any change from my side.

They do run on Tor 0.3.1.9 or 0.3.2.9 in the same Family.

I'm not sure if you are referring to your relays or someone else's relays?

I assume you talk about: https://atlas.torproject.org/#search/contact:1K38x9xqK3YDzjehYFAEPzsESEC4ScH...

it is indeed interesting why some of them have no exit flag, example: https://atlas.torproject.org/#details/B27509F6D6233ACD2EAC8936D5FE7CBF009163...

@David: they don't have badexit flags

2018-01-21 appeas to have been an interesting day indeed https://twitter.com/nusenu_/status/960176185954242560

-- https://mastodon.social/@nusenu twitter: @nusenu_

_______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

_______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

On Fri, Feb 09, 2018 at 07:37:09PM +0100, niftybunny wrote:

Minimum is:

accept *:53 accept *:80 accept *:443

(A) Correct, we recently changed it so both 80 and 443 are required: https://bugs.torproject.org/23637 (B) Port 53 has nothing to do with the exit flag, and it goes mostly unused anyway -- you might think 53 is dns, but most dns is not done in the form of tunneled tcp connections to tcp port 53. --Roger

On Sun, Feb 11, 2018 at 11:55:44AM +0100, Paul wrote:

...

(A) Correct, we recently changed it so both 80 and 443 are required: https://bugs.torproject.org/23637

Thank you for that explanation - how long should it take to get the exit flag back when opening port 80 ?

How long *should* it take? At most an hour -- your relay publishes a new descriptor with the new exit policy, and on the next consensus vote (which happens at the top of each hour), all the dir auths who have seen the new descriptor vote the Exit flag for you. If you meant "how long until Atlas shows that I have it", add a few hours to that, since it pulls its data from onionoo, which pulls from whatever on the metrics side is doing the data fetching and collection. There have been some other issues here and there lately, where your relay publishes a new descriptor, but some of the dir auths decide that it isn't interesting compared to the one they've already got. Your relay publishes a new descriptor every 18 hours in any case, so these rare situations generally work themselves out within a day. So: it should be within an hour, and it likely will be within a day. :) If you want to debug it more, you can fetch the recent votes from https://collector.torproject.org/recent/relay-descriptors/votes/ and see what each of the votes says about your "s" lines. I try to put moria1's most recently seen votes at https://www.freehaven.net/~arma/moria1-v3-status-votes every hour if you want extra fresh data. --Roger

so on that day I guess dir auths updated to the version enforcing 80+443 for exit flag

to confirm this: Dir Auth Tor versions as of 2018-01-19 13:00 +-------------------+------------+ | tor_version | nickname | +-------------------+------------+ | 0.3.1.9 | dannenberg | | 0.3.1.9 | longclaw | | 0.3.1.9 | dizum | | 0.3.1.9 | gabelmoo | | 0.3.1.9 | Bifroest | | 0.3.1.9 | Faravahar | | 0.3.1.9 | maatuska | | 0.3.2.9 | tor26 | | 0.3.3.0-alpha-dev | moria1 | | 0.3.2.9 | bastet | bridge dirauth +-------------------+------------+ Dir Auth Tor versions as of 2018-01-20 12:00 An hour after you lost the exit flag: +-------------------+------------+ | tor_version | nickname | +-------------------+------------+ | 0.3.1.9 | dannenberg | | 0.3.1.9 | longclaw | | 0.3.1.9 | dizum | | 0.3.1.9 | Bifroest | | 0.3.1.9 | Faravahar | | 0.3.1.9 | maatuska | | 0.3.2.9 | gabelmoo | | 0.3.2.9 | tor26 | | 0.3.3.0-alpha-dev | moria1 | | 0.3.2.9 | bastet | bridge dirauth +-------------------+------------+ I'm curious: Why did this change come into effect after only 3/9 having the change deployed? Are only a subset of dir auths responsible for voting about the exit flag? thanks! the change was in 0.3.2.9:

Minor features (directory authority):

Make the "Exit" flag assignment only depend on whether the exit policy allows connections to ports 80 and 443. Previously relays would get the Exit flag if they allowed connections to one of these ports and also port 6667. Resolves ticket 23637.

-- https://mastodon.social/@nusenu twitter: @nusenu_

niftybunny:

The thing is, someone should scan all relays and inform them that their exit flag is gone. We need every exit we can get.

thank you for your input - I sent out that other email to address it (luckily we do not need to scan to gather that kind of data). So back to my question:

Why did this change come into effect after only 3/9 [dirauths] having the change deployed? Are only a subset of dir auths responsible for voting about the exit flag?

-- https://mastodon.social/@nusenu twitter: @nusenu_

It's a good mystery. :) Maybe we can find more recent situations where directory authorities completely left out the Exit flags from their votes?

thanks for your analysis. maybe we can DocTor checks for this and graphs on consensus-health https://lists.torproject.org/pipermail/tor-dev/2018-February/012918.html -- https://mastodon.social/@nusenu twitter: @nusenu_