search

nyxnor / tor-ctrl

Raw use of tor's controller
Other
5 stars 3 forks source link

tor-ctrl-stream failing to save hostname #25

Closed nyxnor closed 2 years ago

nyxnor commented 2 years ago

Checking if Tor Browser 11.0.6 is still phoning home:

tor-ctrl-stream -s 9151 -m -z
StreamId StreamPurpose StreamTarget CircuitId CircuitPurpose
--------------------------------------------------------------------------------------------------------------
15 USER [2a04:4e42:39::201]:443-() 1  GENERAL
16 USER [2a04:4e42:39::201]:443-() 1  GENERAL
17 USER [2a04:4e42:39::201]:443-() 1  GENERAL
18 USER [2606:4700:10::6816:10d4]:443-() 1  GENERAL
19 USER [2606:4700:10::6816:10d4]:443-() 1  GENERAL
20 USER [2606:4700:10::6816:10d4]:443-() 1  GENERAL
21 USER [2606:4700:10::6816:10d4]:443-() 1  GENERAL

The first hostname for streams 15-17 should have been www(dot)https-rulesets.org and for 18-20 securedrop.org

Besides that, another problem was sharing the same circuit, the number 1. What happened to stream isolation?

nyxnor commented 2 years ago 
14 NEW 0 www.https-rulesets.org:443
14 SENTCONNECT 2 www.https-rulesets.org:443
15 NEW 0 www.https-rulesets.org:443
15 SENTCONNECT 2 www.https-rulesets.org:443
16 NEW 0 www.https-rulesets.org:443
16 SENTCONNECT 2 www.https-rulesets.org:443
14 REMAP 2 [2a04:4e42:41::201]:443
14 SUCCEEDED 2 [2a04:4e42:41::201]:443
15 REMAP 2 [2a04:4e42:41::201]:443
15 SUCCEEDED 2 [2a04:4e42:41::201]:443
16 REMAP 2 [2a04:4e42:41::201]:443
16 SUCCEEDED 2 [2a04:4e42:41::201]:443
15 CLOSED 2 [2a04:4e42:41::201]:443
16 CLOSED 2 [2a04:4e42:41::201]:443
17 NEW 0 twitter.com:443
17 SENTCONNECT 6 twitter.com:443
18 NEW 0 securedrop.org:443
18 SENTCONNECT 7 securedrop.org:443
19 NEW 0 securedrop.org:443
19 SENTCONNECT 7 securedrop.org:443
21 NEW 0 securedrop.org:443
20 NEW 0 securedrop.org:443
21 SENTCONNECT 7 securedrop.org:443
20 SENTCONNECT 7 securedrop.org:443
17 REMAP 6 104.244.42.1:443
17 SUCCEEDED 6 104.244.42.1:443
18 REMAP 7 [2606:4700:10::ac43:1da6]:443
18 SUCCEEDED 7 [2606:4700:10::ac43:1da6]:443
19 REMAP 7 [2606:4700:10::ac43:1da6]:443
19 SUCCEEDED 7 [2606:4700:10::ac43:1da6]:443
22 NEW 0 ocsp.digicert.com:80
22 SENTCONNECT 6 ocsp.digicert.com:80
21 REMAP 7 [2606:4700:10::ac43:1da6]:443
21 SUCCEEDED 7 [2606:4700:10::ac43:1da6]:443
20 REMAP 7 [2606:4700:10::ac43:1da6]:443
20 SUCCEEDED 7 [2606:4700:10::ac43:1da6]:443
23 NEW 0 twitter.com:443
23 SENTCONNECT 6 twitter.com:443
22 REMAP 6 93.184.220.29:80
22 SUCCEEDED 6 93.184.220.29:80
19 CLOSED 7 [2606:4700:10::ac43:1da6]:443
23 REMAP 6 104.244.42.1:443
23 SUCCEEDED 6 104.244.42.1:443
20 CLOSED 7 [2606:4700:10::ac43:1da6]:443
21 CLOSED 7 [2606:4700:10::ac43:1da6]:443
24 NEW 0 abs.twimg.com:443
24 SENTCONNECT 6 abs.twimg.com:443
25 NEW 0 abs.twimg.com:443
25 SENTCONNECT 6 abs.twimg.com:443
26 NEW 0 abs.twimg.com:443
26 SENTCONNECT 6 abs.twimg.com:443
24 REMAP 6 [2606:2800:233:8173:898f:63b3:95c3:79d2]:443
24 SUCCEEDED 6 [2606:2800:233:8173:898f:63b3:95c3:79d2]:443
25 REMAP 6 [2606:2800:233:8173:898f:63b3:95c3:79d2]:443
25 SUCCEEDED 6 [2606:2800:233:8173:898f:63b3:95c3:79d2]:443
26 REMAP 6 [2606:2800:233:8173:898f:63b3:95c3:79d2]:443
26 SUCCEEDED 6 [2606:2800:233:8173:898f:63b3:95c3:79d2]:443
25 CLOSED 6 [2606:2800:233:8173:898f:63b3:95c3:79d2]:443
26 CLOSED 6 [2606:2800:233:8173:898f:63b3:95c3:79d2]:443

StreamId StreamPurpose StreamTarget CircuitId CircuitPurpose
--------------------------------------------------------------------------------------------------------------
14 USER [2a04:4e42:41::201]:443-() 2  GENERAL
15 USER [2a04:4e42:41::201]:443-() 2  GENERAL
16 USER [2a04:4e42:41::201]:443-() 2  GENERAL
17 USER 104.244.42.1:443-(twitter.com) 6  GENERAL
18 USER [2606:4700:10::ac43:1da6]:443-(twitter.com) 7  GENERAL
19 USER [2606:4700:10::ac43:1da6]:443-(twitter.com) 7  GENERAL
20 USER [2606:4700:10::ac43:1da6]:443-(twitter.com) 7  GENERAL
21 USER [2606:4700:10::ac43:1da6]:443-(twitter.com) 7  GENERAL
22 USER 93.184.220.29:80-(ocsp.digicert.com) 6  GENERAL
23 USER 104.244.42.1:443-(twitter.com) 6  GENERAL
24 USER [2606:2800:233:8173:898f:63b3:95c3:79d2]:443-(twitter.com) 6  GENERAL
25 USER [2606:2800:233:8173:898f:63b3:95c3:79d2]:443-(twitter.com) 6  GENERAL
26 USER [2606:2800:233:8173:898f:63b3:95c3:79d2]:443-(twitter.com) 6  GENERAL

This is so wrong, what is happening... is the ipv6 brackets [] breaking something?

The correct hostname for each stream should have been:

14 - https-rulesets.org:443
15 - https-rulesets.org:443
16 - https-rulesets.org:443
17 - twitter.com:443
18 - securedrop.org:443
19 - securedrop.org:443
20 - securedrop.org:443
21 - securedrop.org:443
22 - ocsp.digicert.com:80
23 - twitter.com:443
24 - abs.twimg.com:443
25 - abs.twimg.com:443
26 - abs.twimg.com:443
nyxnor commented 2 years ago

indeed it was brackets problem fixed with grep -F for fixed strings.