[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-relays] Faravahar messing with my IP address


On 9 Nov 2015, at 18:56, Matthew Finkel <matthew.finkel@xxxxxxxxx> wrote:

Which version of Tor were you previously running? Have you seen these
messages within the last few days, after you upgraded?


Hi SiNA, Matthew,

I can reproduce some unusual behaviour from Faravahar simply using wget.
It seems that a web cache in front of Faravahar's dirport might be misbehaving.

*Exit Notice - Reproducible Incorrect X-Your-Address-Is*

I just retrieved the Faravahar "exit notice" from a US AWS address, then a few seconds later made a query from an Australian home IP address.

Both queries returned the US AWS address in X-Your-Address-Is.
(A previous query from the Australian address a few minutes beforehand had the correct address.)

I can reproduce this behaviour: whichever query starts first is the one whose IP address gets recorded.

Subsequent queries get the same IP address for several tens of seconds afterwards.

I'm using:
wget --save-headers http://154.35.175.225/

The headers I see look like:

HTTP/1.0 200 OK
Age: 976       
Date: Mon, 09 Nov 2015 08:35:20 GMT
Expires: Mon, 09 Nov 2015 08:55:20 GMT
Connection: Keep-Alive
ETag: "KXJDGONEHLPTLKVYRY"
Content-Type: text/html
X-Your-Address-Is: <not my IP address>
Content-Encoding: identity
Content-Length: 38126

*Directory Documents - Once-Off Header Corruption*

This caching behaviour isn't reproducible with the actual documents, but I did see one instance of corrupted headers:
* Content-Length is misspelt Xontent-Length,
* Connection and ETag are present, but they're not typically present in the headers of other directory documents from Faravahar.
* Expires is in the location it would typically be in for the exit notice (after Date), not the directory documents (last, after Content-Encoding)


HTTP/1.0 200 OK
Age: 975       
Date: Mon, 09 Nov 2015 08:43:32 GMT
Expires: Mon, 09 Nov 2015 09:00:00 GMT
Xontent-Length:           
Connection: Close     
ETag: "KXJDGONEHLSKRWTYRY"
Content-Type: text/plain
X-Your-Address-Is: 180.200.153.214
Content-Encoding: identity

The second download with exactly the same URL did not contain [C|X]ontent-Length, Connection, or ETag.

It's probably worth mentioning that similar queries to other directory authorities do not show the same behaviour.

Tim

Tim Wilson-Brown (teor)

teor2345 at gmail dot com
PGP 968F094B

teor at blah dot im
OTR CAD08081 9755866D 89E2A06F E3558B7F B5A9D14F

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail

_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays