Opened 4 months ago

Closed 4 months ago

Last modified 4 months ago

#27109 closed defect (not a bug)

Tor 0.3.5.0-alpha-dev: [warn] connection_mark_unattached_ap_(): Bug: stream (marked at ../src/core/or/connection_edge.c:2605) sending two socks replies?

Reported by: traumschule Owned by: rl1987
Priority: Medium Milestone: Tor: 0.3.5.x-final
Component: Core Tor/Tor Version: Tor: unspecified
Severity: Normal Keywords: tor-httptunnel
Cc: Actual Points:
Parent ID: #26470 Points:
Reviewer: Sponsor:

Description

This version is more verbose compared to 0.3.4.5-rc. Two messages stick out:

Aug 12 20:05:26.000 [warn] Saying "HTTP/1.0 405 Method Not Allowed\r\n\r\n"
Aug 12 20:05:26.000 [warn] connection_mark_unattached_ap_(): Bug: stream (marked at ../src/core/or/connection_edge.c:2605) sending two socks replies? (on Tor 0.3.5.0-alpha-dev )

Accessing an offline site tor got loud showing the first line many times:

Aug 12 17:54:55.000 [notice] We tried for 15 seconds to connect to '[scrubbed]' using exit $<scrubbed by reporter> at <scrubbed by reporter> . Retrying on a new circuit.
Aug 12 17:55:55.000 [notice] Tried for 125 seconds to get a connection to [scrubbed]:80. Giving up.

Since several days I see:

Aug 12 22:39:00.000 [notice] Bootstrapped 0%: Starting
Aug 12 22:39:01.000 [warn] Illegal nickname "$2947B29E843D@last-listed" in family line

Child Tickets

Change History (11)

comment:1 Changed 4 months ago by traumschule

regularly see this twice:

Aug 13 14:49:19.000 [notice] Tor has successfully opened a circuit. Looks like client functionality is working.
Aug 13 14:49:19.000 [notice] Tor has successfully opened a circuit. Looks like client functionality is working.

comment:2 Changed 4 months ago by rl1987

Owner: set to rl1987
Status: newaccepted

comment:3 Changed 4 months ago by rl1987

How are using tor when you're getting these log messages? Are you sure you're not trying to use it as HTTP proxy?

comment:4 Changed 4 months ago by rl1987

Status: acceptedneeds_information

comment:5 Changed 4 months ago by traumschule

thanks for looking into this!

I am able to reproduce it with firefox using following proxy settings:

HTTP Proxy: 127.0.0.1:9099
SSL Proxy: 127.0.0.1:9099
FTP Proxy: 127.0.0.1:9099
SOCKS Host: 127.0.0.1:9050

/etc/tor/torrc

SocksPort 9050
HTTPTunnelPort 9099

I noticed the helpful message by tor using the SOCKS port for TLS ("SSL Proxy: 127.0.0.1:9050"):

[warn] Socks version 67 not recognized. (This port is not an HTTP proxy; did you want to use
HTTPTunnelPort?)

comment:6 Changed 4 months ago by traumschule

Keywords: tor-httptunnel added

comment:7 Changed 4 months ago by traumschule

Status: needs_informationassigned

i noticed it only happened when firefox is running, so I changed the proxy settings to the TBB defaults

  • blank for HTTP SSL FTP
  • SOCKS Host: 127.0.0.1:9050

and no warning since.
Then I removed this proxy as well because it's a terrible idea to use tor as proxy for firefox aiming for anonymization. It's easy to see with dnsleaktest.com that the ip address is not changing for new tabs.

comment:8 Changed 4 months ago by rl1987

We strongly recommend to use TBB for web browsing. It has been patched to fight application layer privacy leaks and deanonymisation attacks.

comment:9 Changed 4 months ago by rl1987

Resolution: not a bug
Status: assignedclosed

Closing as it seems to have been configuration mistake.

comment:10 Changed 4 months ago by arma

Seems like this *is* a bug, right? The Tor log line says "Bug:" and it shouldn't hit that line, even if you configure it or use it in a surprising way.

comment:11 Changed 4 months ago by teor

Parent ID: #26470

If it is a bug, it's a duplicate of #26470.

Note: See TracTickets for help on using tickets.