[tor-commits] [doctor/master] Check ORPort reachability

[atagar at torproject.org]

commit 138ac2c58b58297ef8301419d97717919ffb6790
Author: Damian Johnson <atagar at torproject.org>
Date:   Fri May 27 09:11:17 2016 -0700

    Check ORPort reachability
    
    Simple check that was requested at the Berlin dev meeting to see if the
    authority's ORPort is reachable...
    
      https://trac.torproject.org/projects/tor/ticket/18176
    
    This has been pending IPv6 support. Now that DocTor's running on carinatum this
    can become a thing!
    
      https://trac.torproject.org/projects/tor/ticket/17298
---
 consensus_health_checker.py | 37 +++++++++++++++----------------------
 data/consensus_health.cfg   |  1 +
 2 files changed, 16 insertions(+), 22 deletions(-)

diff --git a/consensus_health_checker.py b/consensus_health_checker.py
index c521e64..c1aed79 100755
--- a/consensus_health_checker.py
+++ b/consensus_health_checker.py
@@ -325,6 +325,7 @@ def run_checks(consensuses, votes):
     is_recommended_versions,
     bad_exits_in_sync,
     bandwidth_authorities_in_sync,
+    is_orport_reachable,
   )
 
   all_issues = []
@@ -580,7 +581,7 @@ def unmeasured_relays(latest_consensus, consensuses, votes):
       percentage = 100 * unmeasured / total
 
       if percentage >= 5:
-        issues.append(Issue(Runlevel.NOTICE, 'TOO_MANY_UNMEASURED_RELAYS', authority = authority, unmeasured = unmeasured, total = total, percentage = percentage, to = [authority]))
+        issues.append(Issue(Runlevel.NOTICE, 'TOO_MANY_UNMEASURED_RELAYS', authority = authority.nickname, unmeasured = unmeasured, total = total, percentage = percentage, to = [authority]))
 
   return issues
 
@@ -613,6 +614,7 @@ def has_expected_fingerprints(latest_consensus, consensuses, votes):
   "Checks that the authorities have the fingerprints that we expect."
 
   issues = []
+
   for desc in latest_consensus.routers.values():
     if desc.nickname in DIRECTORY_AUTHORITIES and Flag.NAMED in desc.flags:
       expected_fingerprint = DIRECTORY_AUTHORITIES[desc.nickname].fingerprint
@@ -686,7 +688,7 @@ def bad_exits_in_sync(latest_consensus, consensuses, votes):
       attr.append('without flag: %s' % ', '.join(without_flag))
 
     if not_in_vote:
-      attr.append('not in consensus: %s' % ', '.join(not_in_vote))
+      attr.append('not in vote: %s' % ', '.join(not_in_vote))
 
     issues.append(Issue(Runlevel.NOTICE, 'BADEXIT_OUT_OF_SYNC', fingerprint = fingerprint, counts = ', '.join(attr), to = bad_exits.keys()))
 
@@ -719,10 +721,9 @@ def bandwidth_authorities_in_sync(latest_consensus, consensuses, votes):
       return Issue(Runlevel.NOTICE, 'BANDWIDTH_AUTHORITIES_OUT_OF_SYNC', authorities = ', '.join(entries), to = measurement_counts.keys())
 
 
-def is_ipv6_orport_reachable(latest_consensus, consensuses, votes):
+def is_orport_reachable(latest_consensus, consensuses, votes):
   """
-  Simple check to see if we can reach the authority's IPv6 ORPort when it has
-  one.
+  Simple check to see if we can reach the authority's ORPort.
   """
 
   issues = []
@@ -734,22 +735,14 @@ def is_ipv6_orport_reachable(latest_consensus, consensuses, votes):
       continue  # authority isn't in the consensus
 
     for address, port, is_ipv6 in desc.or_addresses:
-      if is_ipv6:
-        # TODO: Ok, now for the bit I'm unfamiliar with. How do we ping
-        # this endpoint? On cappadocicum seems we're missing something...
-        #
-        #   % ping6 2001:858:2:2:aabb:0:563b:1526
-        #   connect: Network is unreachable
-        #
-        # Do we need a tunnel? 6to4 configuration?
-        #
-        #   https://wiki.debian.org/DebianIPv6#IPv6_6to4_Configuration
-        #
-        # Green to this space so lets ask...
-
-        orport_socket = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
+      orport_socket = socket.socket(socket.AF_INET6 if is_ipv6 else socket.AF_INET, socket.SOCK_STREAM)
+
+      try:
         orport_socket.connect((address, port))
-        # ???
+      except Exception as exc:
+        issues.append(Issue(Runlevel.WARNING, 'UNABLE_TO_REACH_ORPORT', authority = authority.nickname, address = address, port = port, error = exc, to = [authority]))
+      finally:
+        orport_socket.close()
 
   return issues
 
@@ -799,9 +792,9 @@ def _get_documents(label, resource):
     median_time = sorted(times_taken.values())[len(times_taken) / 2]
     authority_times = ', '.join(['%s => %0.1fs' % (authority, time_taken) for authority, time_taken in times_taken.items()])
 
-    for authority, time_taken in times_taken.items():
+    for nickname, time_taken in times_taken.items():
       if time_taken > median_time * 5:
-        issues.append(Issue(Runlevel.NOTICE, 'LATENCY', authority = authority, time_taken = '%0.1fs' % time_taken, median_time = '%0.1fs' % median_time, authority_times = authority_times, to = [authority]))
+        issues.append(Issue(Runlevel.NOTICE, 'LATENCY', authority = nickname, time_taken = '%0.1fs' % time_taken, median_time = '%0.1fs' % median_time, authority_times = authority_times, to = [nickname]))
 
   return documents, issues
 
diff --git a/data/consensus_health.cfg b/data/consensus_health.cfg
index 6d72cac..5630207 100644
--- a/data/consensus_health.cfg
+++ b/data/consensus_health.cfg
@@ -19,6 +19,7 @@ msg TOR_OUT_OF_DATE =>  The following authorities are an out of date version of
 msg BADEXIT_OUT_OF_SYNC => Authorities disagree about the BadExit flag for {fingerprint} ({counts})
 msg BANDWIDTH_AUTHORITIES_OUT_OF_SYNC => Bandwidth authorities have a substantially different number of measured entries: {authorities}
 msg AUTHORITY_UNAVAILABLE => Unable to retrieve the {fetch_type} from {authority} ({url}): {error}
+msg UNABLE_TO_REACH_ORPORT => Unable to reach the ORPort of {authority} ({address}, port {port}): {error}
 
 # hours that we'll suppress messages if it hasn't changed