Opened 5 years ago

Last modified 3 years ago

#10499 new defect

Wrong atlas link on check.torproject.org

Reported by: erchewin Owned by: arlolra
Priority: Medium Milestone:
Component: Applications/Tor Check Version:
Severity: Normal Keywords:
Cc: jens@…, david@… Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

Hello
I discovered that it happens that check.torproject.org may show correct exit IP address, but wrong link to Atlas page. See example of such check.torproject.org output in attachment. It reports exit IP 77.220.136.220 but link to atlas leads to page https://atlas.torproject.org/#details/8450F3CA4006D2F84B1F7FB70E03BDE8F55D84C0 (node 76.74.178.217). Sometimes is shows correct link https://atlas.torproject.org/#details/32556374840964DEF82CC8198479A65274956AF9
I use HTTPS, so exit node can't be responsible for this. This must be check.torproject.org's bug.

Child Tickets

Attachments (1)

check.t.o.html (7.0 KB) - added by erchewin 5 years ago.
output of check.torproject.org

Download all attachments as: .zip

Change History (10)

Changed 5 years ago by erchewin

Attachment: check.t.o.html added

output of check.torproject.org

comment:1 Changed 5 years ago by arlolra

Thanks for reporting. This is indeed a problem with check although the metrics archive (https://metrics.torproject.org/data.html#exitlist) has seen that node at that IP. It could a problem with TorDNSEL but maybe multiple nodes are being hosted at the same IP, in which case check would have a hard time distinguishing between them.

./14/2013-12-14-06-02-02:ExitNode 8450F3CA4006D2F84B1F7FB70E03BDE8F55D84C0
./14/2013-12-14-06-02-02-Published 2013-12-14 00:29:38
./14/2013-12-14-06-02-02-LastStatus 2013-12-14 01:02:49
./14/2013-12-14-06-02-02-ExitAddress 77.220.136.220 2013-12-13 06:36:53
--
./14/2013-12-14-07-02-05:ExitNode 8450F3CA4006D2F84B1F7FB70E03BDE8F55D84C0
./14/2013-12-14-07-02-05-Published 2013-12-14 00:29:38
./14/2013-12-14-07-02-05-LastStatus 2013-12-14 01:02:49
./14/2013-12-14-07-02-05-ExitAddress 178.73.206.148 2013-12-14 01:03:14

comment:2 Changed 5 years ago by erchewin

Another example: using exit with IP 77.109.139.26, link was shown to atlas page for 4B0F4B1CA8C0FC112C197A253BAF89128F8039BF (node with IP 5.135.183.211). Real fingerprint of 77.109.139.26 is ECB84BBD1FC44CE4234CA8DB274939E4F3238840.

These nodes are in different countries, as nodes from first case. I think, a node is unlikely to walk across the world and host on different IP, moreover on IP of other nodes! It must be bug in the system responsible for tracking IP of nodes or nodes are reporting false IP (intentionally or due to error).

comment:3 Changed 5 years ago by arlolra

Moving nodes between servers is not an issue, it's the "moreover on IP of other nodes!" that concerns me. This is looking more like a bug in TorDNSEL. The following from the exit list in December,

./29/2013-12-29-03-02-03:ExitNode 4B0F4B1CA8C0FC112C197A253BAF89128F8039BF
./29/2013-12-29-03-02-03-Published 2013-12-28 02:32:51
./29/2013-12-29-03-02-03-LastStatus 2013-12-29 02:03:19
./29/2013-12-29-03-02-03-ExitAddress 96.44.189.102 2013-12-28 03:03:32
./29/2013-12-29-03-02-03-ExitAddress 94.126.178.1 2013-12-28 03:03:35
./29/2013-12-29-03-02-03-ExitAddress 77.247.181.165 2013-12-28 03:03:45
./29/2013-12-29-03-02-03-ExitAddress 185.2.138.125 2013-12-28 03:03:46
./29/2013-12-29-03-02-03-ExitAddress 31.172.30.3 2013-12-28 03:03:48
./29/2013-12-29-03-02-03-ExitAddress 96.44.189.100 2013-12-28 03:03:51
./29/2013-12-29-03-02-03-ExitAddress 77.109.139.26 2013-12-28 03:03:57
./29/2013-12-29-03-02-03-ExitAddress 94.242.252.41 2013-12-28 03:06:08
./29/2013-12-29-03-02-03-ExitAddress 166.70.207.2 2013-12-28 03:06:51
./29/2013-12-29-03-02-03-ExitAddress 192.198.82.244 2013-12-28 03:06:51
./29/2013-12-29-03-02-03-ExitAddress 171.25.193.20 2013-12-28 03:06:56
./29/2013-12-29-03-02-03-ExitAddress 212.83.151.26 2013-12-28 03:06:58
./29/2013-12-29-03-02-03-ExitAddress 77.247.181.162 2013-12-28 03:06:59

Seems very unlikely that a node would have been seen at all those IPs.

comment:4 in reply to:  1 Changed 5 years ago by karsten

Replying to arlolra:

[...] but maybe multiple nodes are being hosted at the same IP, in which case check would have a hard time distinguishing between them.

This is indeed a problem that check cannot solve. Maybe check should instead link to Atlas' search page for the connecting IP address, e.g., https://atlas.torproject.org/#search/76.74.178.217 , and if there are two relays running on the same address, the user will see two search results.

comment:5 Changed 5 years ago by qbi

Cc: jens@… added

JFTR: There was also a question at our Q&A site: http://tor.stackexchange.com/q/1439/88

comment:6 Changed 5 years ago by arlolra

More evidence in #11058.

comment:7 Changed 5 years ago by dkm

Cc: david@… added

comment:8 Changed 3 years ago by arlolra

Severity: Normal

See also #18078.

comment:9 Changed 3 years ago by arlolra

See also #20114.

Note: See TracTickets for help on using tickets.