[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-talk] glibc's DNS lookups fail

To: tor-talk@xxxxxxxxxxxxxxxxxxxx
Subject: Re: [tor-talk] glibc's DNS lookups fail
From: douglastskillern@xxxxxxxxxxx
Date: Tue, 14 Feb 2012 14:36:34 -0500 (EST)
Delivered-to: archiver@xxxxxxxx
Delivery-date: Tue, 14 Feb 2012 14:36:53 -0500
Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=lavabit; d=lavabit.com; b=GGE3k41gaWuFSvtzPc15+rgyDUs63X2AgHx0JUE/ShkOnr01lnHbksZ3hsStLGAnn4mIxQJbGLH5ADSx8+6bOe3dfVuF6RHQtlWhN6gNInQ6l1zwsotjn2TUuMb96hWIAowxaEo5Xyh8griLp0ldNQi+NOz9W2v6BJAWbCKtq/I=; h=Message-ID:Date:Subject:From:To:User-Agent:MIME-Version:Content-Type:Content-Transfer-Encoding;
List-archive: <http://lists.torproject.org/pipermail/tor-talk>
List-help: <mailto:tor-talk-request@lists.torproject.org?subject=help>
List-id: "This mailing list is for all discussion about theory, design, and development of Onion Routing." <tor-talk.lists.torproject.org>
List-post: <mailto:tor-talk@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk>, <mailto:tor-talk-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-talk>, <mailto:tor-talk-request@lists.torproject.org?subject=unsubscribe>
Reply-to: tor-talk@xxxxxxxxxxxxxxxxxxxx
Sender: tor-talk-bounces@xxxxxxxxxxxxxxxxxxxx
User-agent: SquirrelMail/1.4.13

> On Tue, Feb 14, 2012 at 02:43:44AM -0500, douglastskillern@xxxxxxxxxxx
> wrote:
>> 1     0.000000        192.168.178.30  127.0.0.1       DNS     Standard
>> query A torproject.org
>> 2     0.000027        192.168.178.30  127.0.0.1       DNS     Standard
>> query AAAA torproject.org
>> 3     0.000155        192.168.178.1   192.168.178.30  DNS     Standard
>> query response, Not
>> implemented
>> # tor does its magic
>> 8     1.157351        192.168.178.1   192.168.178.30  DNS     Standard
>> query response A
>> 38.229.72.14
>
> The IP you're sending to and the IP you're receiving form don't match. The
> glibc stub resolver probably trashes these.
>
> Also: tcpdump output is way easier to read. Please include that (if this
> doesn't fix the problem).

Thank you very much for your reply.

I agree, the IPs are odd.  I have no idea how to fix it, though.
Also, the wrong IPs do not explain why subsequent requests work just fine.
 BTW. I am running the very same setup (Debian 6 x86-64, tor, the same
iptables init script) in a VM, and everything just works fine.

Anyway, here is the tcpdump output.  (I changed the ports of TOR; 9034 for
DNS, 9044 for TCP.)

================================================================================
~$ date; gnutls-cli -p 80 --starttls torproject.org; date
Tue Feb 14 20:18:54
Resolving 'torproject.org'...
Cannot resolve torproject.org:80: Name or service not known
Tue Feb 14 20:18:55
~$ date; gnutls-cli -p 80 --starttls torproject.org; date
Tue Feb 14 20:18:58
Resolving 'torproject.org'...
Connecting to '86.59.30.36:80'...

- Simple Client Mode:

  C-c C-cTue Feb 14 20:19:00
~$
================================================================================

================================================================================
# tcpdump -i any -vvv -n
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture
size 65535 bytes
20:18:54.786132 IP (tos 0x0, ttl 64, id 50012, offset 0, flags [DF], proto
UDP (17), length 60)
    192.168.178.30.46196 > 127.0.0.1.9034: [bad udp cksum 5b6a!] UDP,
length 32
20:18:54.786158 IP (tos 0x0, ttl 64, id 50013, offset 0, flags [DF], proto
UDP (17), length 60)
    192.168.178.30.46196 > 127.0.0.1.9034: [bad udp cksum 1543!] UDP,
length 32
20:18:54.786311 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP
(17), length 60)
    192.168.178.1.53 > 192.168.178.30.46196: [bad udp cksum 53fe!] 63044
NotImp q: AAAA? torproject.org. 0/0/0 (32)
20:18:54.786388 IP (tos 0x0, ttl 64, id 43323, offset 0, flags [DF], proto
TCP (6), length 638)
    192.168.178.30.35661 > 91.208.34.12.443: Flags [P.], cksum 0xf313
(incorrect -> 0x2b34), seq 1897602385:1897602971, ack 2005900685, win
501, options [nop,nop,TS val 443228 ecr 3821623177], length 586
20:18:54.834595 IP (tos 0x0, ttl 55, id 38365, offset 0, flags [DF], proto
TCP (6), length 52)
    91.208.34.12.443 > 192.168.178.30.35661: Flags [.], cksum 0x49ae
(correct), seq 1, ack 586, win 501, options [nop,nop,TS val 3821625454
ecr 443228], length 0
20:18:55.352008 IP (tos 0x0, ttl 55, id 38366, offset 0, flags [DF], proto
TCP (6), length 638)
    91.208.34.12.443 > 192.168.178.30.35661: Flags [P.], cksum 0xde75
(correct), seq 1:587, ack 586, win 501, options [nop,nop,TS val
3821625583 ecr 443228], length 586
20:18:55.352038 IP (tos 0x0, ttl 64, id 43324, offset 0, flags [DF], proto
TCP (6), length 52)
    192.168.178.30.35661 > 91.208.34.12.443: Flags [.], cksum 0x4655
(correct), seq 586, ack 587, win 501, options [nop,nop,TS val 443370
ecr 3821625583], length 0
20:18:55.352158 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP
(17), length 76)
    192.168.178.1.53 > 192.168.178.30.46196: [bad udp cksum 76ed!] 53017
q: A? torproject.org. 1/0/0 torproject.org. [15m] A 86.59.30.36 (48)
20:18:55.352246 IP (tos 0x0, ttl 64, id 50154, offset 0, flags [DF], proto
UDP (17), length 70)
    192.168.178.30.41015 > 127.0.0.1.9034: [bad udp cksum d6b!] UDP,
length 42
20:18:55.352260 IP (tos 0x0, ttl 64, id 50155, offset 0, flags [DF], proto
UDP (17), length 70)
    192.168.178.30.41015 > 127.0.0.1.9034: [bad udp cksum 23e!] UDP,
length 42
20:18:55.352340 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP
(17), length 70)
    192.168.178.1.53 > 192.168.178.30.41015: [bad udp cksum 40f9!] 60183
NotImp q: AAAA? torproject.org.my.search.domain. 0/0/0 (42)
20:18:55.352375 IP (tos 0x0, ttl 64, id 43325, offset 0, flags [DF], proto
TCP (6), length 638)
    192.168.178.30.35661 > 91.208.34.12.443: Flags [P.], cksum 0xf313
(incorrect -> 0xa599), seq 586:1172, ack 587, win 501, options
[nop,nop,TS val 443370 ecr 3821625583], length 586
20:18:55.400657 IP (tos 0x0, ttl 55, id 38367, offset 0, flags [DF], proto
TCP (6), length 52)
    91.208.34.12.443 > 192.168.178.30.35661: Flags [.], cksum 0x43fe
(correct), seq 587, ack 1172, win 501, options [nop,nop,TS val
3821625596 ecr 443370], length 0
20:18:55.753876 IP (tos 0x0, ttl 55, id 38368, offset 0, flags [DF], proto
TCP (6), length 638)
    91.208.34.12.443 > 192.168.178.30.35661: Flags [P.], cksum 0x9332
(correct), seq 587:1173, ack 1172, win 501, options [nop,nop,TS val
3821625684 ecr 443370], length 586
20:18:55.754011 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP
(17), length 70)
    192.168.178.1.53 > 192.168.178.30.41015: [bad udp cksum 4d26!] 48679
NXDomain q: A? torproject.org.my.search.domain. 0/0/0 (42)
20:18:55.791424 IP (tos 0x0, ttl 64, id 43326, offset 0, flags [DF], proto
TCP (6), length 52)
    192.168.178.30.35661 > 91.208.34.12.443: Flags [.], cksum 0x40ee
(correct), seq 1172, ack 1173, win 501, options [nop,nop,TS val 443480
ecr 3821625684], length 0
20:18:58.291364 IP (tos 0x0, ttl 64, id 50888, offset 0, flags [DF], proto
UDP (17), length 60)
    192.168.178.30.54167 > 127.0.0.1.9034: [bad udp cksum 5369!] UDP,
length 32
20:18:58.291385 IP (tos 0x0, ttl 64, id 50889, offset 0, flags [DF], proto
UDP (17), length 60)
    192.168.178.30.54167 > 127.0.0.1.9034: [bad udp cksum 28e3!] UDP,
length 32
20:18:58.291450 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP
(17), length 76)
    192.168.178.1.53 > 192.168.178.30.54167: [bad udp cksum b6ef!] 45310
q: A? torproject.org. 1/0/0 torproject.org. [1m] A 86.59.30.36 (48)
20:18:58.291466 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP
(17), length 60)
    192.168.178.1.53 > 192.168.178.30.54167: [bad udp cksum 679e!] 14094
NotImp q: AAAA? torproject.org. 0/0/0 (32)
20:18:58.291551 IP (tos 0x0, ttl 64, id 5504, offset 0, flags [DF], proto
TCP (6), length 60)
    192.168.178.30.35769 > 127.0.0.1.9044: Flags [S], cksum 0x42b2
(correct), seq 3012481865, win 5840, options [mss 1460,sackOK,TS val
444105 ecr 0,nop,wscale 7], length 0
20:18:58.291565 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP
(6), length 60)
    86.59.30.36.80 > 192.168.178.30.35769: Flags [S.], cksum 0x08f5
(correct), seq 2414963976, ack 3012481866, win 32768, options [mss
16396,sackOK,TS val 444105 ecr 444105,nop,wscale 7], length 0
20:18:58.291579 IP (tos 0x0, ttl 64, id 5505, offset 0, flags [DF], proto
TCP (6), length 52)
    192.168.178.30.35769 > 127.0.0.1.9044: Flags [.], cksum 0xc445
(correct), seq 3012481866, ack 2414963977, win 46, options [nop,nop,TS
val 444105 ecr 444105], length 0
20:18:58.291826 IP (tos 0x0, ttl 64, id 43327, offset 0, flags [DF], proto
TCP (6), length 638)
    192.168.178.30.35661 > 91.208.34.12.443: Flags [P.], cksum 0xf313
(incorrect -> 0x3860), seq 1172:1758, ack 1173, win 501, options
[nop,nop,TS val 444105 ecr 3821625684], length 586
20:18:58.340250 IP (tos 0x0, ttl 55, id 38369, offset 0, flags [DF], proto
TCP (6), length 52)
    91.208.34.12.443 > 192.168.178.30.35661: Flags [.], cksum 0x39ac
(correct), seq 1173, ack 1758, win 501, options [nop,nop,TS val
3821626331 ecr 444105], length 0
20:18:58.757775 IP (tos 0x0, ttl 55, id 38370, offset 0, flags [DF], proto
TCP (6), length 638)
    91.208.34.12.443 > 192.168.178.30.35661: Flags [P.], cksum 0x1989
(correct), seq 1173:1759, ack 1758, win 501, options [nop,nop,TS val
3821626435 ecr 444105], length 586
20:18:58.757816 IP (tos 0x0, ttl 64, id 43328, offset 0, flags [DF], proto
TCP (6), length 52)
    192.168.178.30.35661 > 91.208.34.12.443: Flags [.], cksum 0x3686
(correct), seq 1758, ack 1759, win 501, options [nop,nop,TS val 444221
ecr 3821626435], length 0
20:19:00.564174 IP (tos 0x0, ttl 64, id 5506, offset 0, flags [DF], proto
TCP (6), length 52)
    192.168.178.30.35769 > 127.0.0.1.9044: Flags [F.], cksum 0xc20c
(correct), seq 0, ack 1, win 46, options [nop,nop,TS val 444673 ecr
444105], length 0
20:19:00.564302 IP (tos 0x0, ttl 64, id 43968, offset 0, flags [DF], proto
TCP (6), length 52)
    86.59.30.36.80 > 192.168.178.30.35769: Flags [F.], cksum 0xeca7
(correct), seq 1, ack 2, win 256, options [nop,nop,TS val 444673 ecr
444673], length 0
20:19:00.564323 IP (tos 0x0, ttl 64, id 5507, offset 0, flags [DF], proto
TCP (6), length 52)
    192.168.178.30.35769 > 127.0.0.1.9044: Flags [.], cksum 0xbfd3
(correct), seq 1, ack 2, win 46, options [nop,nop,TS val 444673 ecr
444673], length 0
20:19:00.564385 IP (tos 0x0, ttl 64, id 43329, offset 0, flags [DF], proto
TCP (6), length 638)
    192.168.178.30.35661 > 91.208.34.12.443: Flags [P.], cksum 0xf313
(incorrect -> 0xe5e0), seq 1758:2344, ack 1759, win 501, options
[nop,nop,TS val 444673 ecr 3821626435], length 586
20:19:00.611980 IP (tos 0x0, ttl 55, id 38371, offset 0, flags [DF], proto
TCP (6), length 52)
    91.208.34.12.443 > 192.168.178.30.35661: Flags [.], cksum 0x30a9
(correct), seq 1759, ack 2344, win 501, options [nop,nop,TS val
3821626898 ecr 444673], length 0
  C-c C-c
32 packets captured
50 packets received by filter
0 packets dropped by kernel
================================================================================

Cheers,

Douglas


_______________________________________________
tor-talk mailing list
tor-talk@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

Follow-Ups:
- Re: [tor-talk] glibc's DNS lookups fail
  - From: douglastskillern

Prev by Author: [tor-talk] glibc's DNS lookups fail
Next by Author: Re: [tor-talk] glibc's DNS lookups fail
Previous by thread: Re: [tor-talk] glibc's DNS lookups fail
Next by thread: Re: [tor-talk] glibc's DNS lookups fail
Index(es):
- Author
- Thread