Opened 9 years ago

Closed 8 years ago

Last modified 7 years ago

#2752 closed defect (fixed)

Tor limits HttpProxyAuthenticator values to 48 characters

Reported by: dudumomo Owned by: chiiph
Priority: Medium Milestone: Tor: 0.2.2.x-final
Component: Core Tor/Tor Version: Tor: 0.2.2.23-alpha
Severity: Keywords: 48 chars http proxy easy tor-client
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

Being under a proxy, I've tried to use TOR with vidalia.
However, when I try to configure Vidalia with my proxy setting, I got the error: "Vidalia was unable to apply your Network settings to Tor. Unacceptable option value: HttpProxyAuthenticator is too long (>= 48 chars)." Indeed, I'm using a login of 41 chars + a password of 10 chars.

How to solve this problem?

Child Tickets

Change History (12)

comment:1 Changed 9 years ago by Sebastian

Component: VidaliaTor Client
Version: Vidalia 0.2.10Tor: 0.2.2.23-alpha

Thanks for filing this report, it is an issue inside Tor, not Vidalia. Adjusting the ticket

comment:2 Changed 9 years ago by rransom

Milestone: Tor Browser Bundle for Windows
Priority: majornormal
Summary: Vidalia was unable to apply your Network settings to Tor. Unacceptable option value: HttpProxyAuthenticator is too long (>= 48 chars).Tor limits HttpProxyAuthenticator values to 48 characters

This bug is also present on maint-0.2.1.

The problem seems to be that our base64_encode function uses OpenSSL's base64 encoder, which inserts newlines, and we didn't want to strip newlines out of the middle of the encoded string in alloc_http_authenticator.

comment:3 Changed 9 years ago by nickm

Keywords: easy added

It shouldn't be all that hard to do, so long as somebody's willing to write the code. Marking this as "easy"; it's a basic C string manipulation problem fwict. All you'd need to do, IIUC, is fix up the "else" case in alloc_http_authenticator.

comment:4 Changed 8 years ago by nickm

Milestone: Tor: 0.2.3.x-final

comment:5 Changed 8 years ago by mikey

Seems like there is a real hard-coded limit of 48 (the user needs 51 characters at least):

if (options->HTTPProxyAuthenticator) {

if (strlen(options->HTTPProxyAuthenticator) >= 48)

REJECT("HTTPProxyAuthenticator is too long (>= 48 chars).");

}

So newlines aren't necessarily the issue here until this limit is raised.
Not sure what the next step here is.

comment:6 Changed 8 years ago by nickm

I think the reason that code is there is because of the base64 encoding. If you took out the newlines, I think it would be okay to remove the hard-coded limit.

comment:7 Changed 8 years ago by mikey

Milestone: Tor: 0.2.3.x-finalTor: 0.2.2.x-final
Status: newneeds_review

Ah, yes, silly me.
Implemented the newline removal in the else clause alloc_http_authenticator
I left the char max check in , but changed it to 512 from 48 in config.c

https://github.com/mikey99/tor/tree/bug2752

Based on the maint-0.2.2 branch.

comment:8 Changed 8 years ago by nickm

Looks good to me! I'll merge it once 0.2.2.26 is out.

comment:9 Changed 8 years ago by nickm

mikey notes on IRC that the bug number in the changes file is wrong.

comment:10 Changed 8 years ago by nickm

Resolution: fixed
Status: needs_reviewclosed

Merged into maint-0.2.2 and master; thanks again!

comment:11 Changed 7 years ago by nickm

Keywords: tor-client added

comment:12 Changed 7 years ago by nickm

Component: Tor ClientTor
Note: See TracTickets for help on using tickets.