[tor-talk] Bug Remains: OpenSSL library does not load unless bridges are used

[ming@xxxxxxxxxxx]

This is a followup post on this issue which persists in Linux TBB 32bit, version 2.2.37-2.

Any idea for the cause?

What occurs when it doesn't list the library loading (is the library loading?) and why it's listed
only on a TBB reload?

Below is a copy/paste from my original post as a refresher:

(I do realize a bug report page/ticket for this exists, but has it been updated?)
---------
 __
_||_
\  /
 \/
,----------,
:Example A : Loaded via start-tor-browser script without any changes, fresh install of current TBB:
'----------'
Tor v0.2.2.35 (git-[snip]). This is experimental software. Do not rely on it for strong anonymity.
(Running on Linux i686)
Initialized libevent version 2.0.19-stable using method epoll. Good.
Opening Socks listener on 127.0.0.1:0
Socks listener listening on port [snip].
Opening Control listener on 127.0.0.1:0
Control listener listening on port [snip].
Parsing GEOIP file ./Data/Tor/geoip.
Bootstrapped 10%: Finishing handshake with directory server.
Bootstrapped 15%: Establishing an encrypted directory connection.
[snip]
Tor has successfully opened a circuit. Looks like client functionality is working.
Bootstrapped 100%: Done.
------------
() Example A/Notations/Questions and fact: The OpenSSL library is not loaded in Vidalia's Message
Log.

1. How is it establishing an encrypted directory connection and continues to function without
loading the OpenSSL library?
2. Is it loading the OpenSSL library but suppressing the text output in Vidalia for some reason?
3. Is my TBB session, when loaded with the process in Example A, vulnerable to attack (MiTM/Or..)?
4. Is my TBB session, when loaded with the process in Example A, really encrypting content? One
would think there would be errors and/or a failure to start correctly if OpenSSL isn't loaded at
start.
5. The graphic on the Tor check page: https://check.torproject.org/images/tor-on.png does not load!
6. Could this be a case of Tor connecting to a "faked/private" Tor network, maybe ISP or hacker
(MiTM) based?
7. Randomly, I notice when checking the exit node for validity, it is shown as not part of the
network.

 __
_||_
\  /
 \/
,----------,
:Example B : But, when I add and use bridges, exit and restart TBB, the OpenSSL library loads:
'----------'
Tor v0.2.2.35 (git-[snip]). This is experimental software. Do not rely on it for strong anonymity.
(Running on Linux i686)
Initialized libevent version 2.0.19-stable using method epoll. Good.
Opening Socks listener on 127.0.0.1:0
Socks listener listening on port [snip].
Opening Control listener on 127.0.0.1:0
Control listener listening on port [snip].
Parsing GEOIP file ./Data/Tor/geoip.
OpenSSL OpenSSL 1.0.1c 10 May 2012 looks like version 0.9.8m or later; I will try SSL_OP to enable
renegotiation
new bridge descriptor '[snip]' (cached)
[snip]
We now have enough directory information to build circuits.
Bootstrapped 80%: Connecting to the Tor network.
New control connection opened.
Bootstrapped 85%: Finishing handshake with first hop.
Learned fingerprint [snip] for bridge [snip:snip]
Bootstrapped 90%: Establishing a Tor circuit.
Tor has successfully opened a circuit. Looks like client functionality is working.
Bootstrapped 100%: Done.
------------
() Example B/Notations and Question (#4)

1. The graphic on the Tor check page: https://check.torproject.org/images/tor-on.png loads!
2. The OpenSSL library loads!
3. Unlike #7 above, exit node reports are always positive.
(?)4. Strange "rediscovery" of known bridges, appearing as "new bridge descriptor 'name' (fresh)"
   but they were manually imported through Vidalia and shown within the Message Log earlier as
   a Learned Fingerprint and a 'name' (cached). If the TBB session remains active for several
   hours, these manually entered bridges continue to repeat being discovered as (fresh)!
   Is this a bridge poisoning attack?
------------

x What is occurring with Example A and B regarding the OpenSSL Lib?
x What is occurring with Example B Question line #4?

_______________________________________________
tor-talk mailing list
tor-talk@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk