Opened 11 months ago

Closed 10 months ago

Last modified 9 months ago

#27774 closed defect (fixed)

hs-v3: Assertion onion_pk failed in introduce1_set_encrypted_onion_key

Reported by: dgoulet Owned by:
Priority: Medium Milestone: Tor: 0.3.4.x-final
Component: Core Tor/Tor Version: Tor: 0.3.3.9
Severity: Normal Keywords: tor-hs, 034-backport
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

From #tor on IRC, someone using Tor Browser hit this. I would bet anything that #27471 is also related in some way.

9/18/18, 17:42:12.963 [ERR] tor_assertion_failed_(): Bug: src/or/hs_cell.c:256: introduce1_set_encrypted_onion_key: Assertion onion_pk failed; aborting. (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.964 [ERR] Bug: Assertion onion_pk failed in introduce1_set_encrypted_onion_key at src/or/hs_cell.c:256. Stack trace: (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.965 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(log_backtrace+0x44) [0x5601001fa314] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.965 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(tor_assertion_failed_+0x8d) [0x56010021587d] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.965 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(hs_cell_build_introduce1+0x457) [0x5601001f5ee7] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.965 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(hs_circ_send_introduce1+0x296) [0x5601001d4596] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.965 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(hs_client_send_introduce1+0x159) [0x5601001d7299] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.965 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(connection_ap_handshake_attach_circuit+0x860) [0x56010015f210] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.966 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(connection_ap_attach_pending+0x1a8) [0x560100180308] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.966 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(circuit_send_next_onion_skin+0x372) [0x560100149762] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.967 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(+0x7be34) [0x5601000ece34] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.967 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(circuit_receive_relay_cell+0x329) [0x5601000eee59] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.967 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(command_process_cell+0x180) [0x56010015ff40] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.967 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(channel_tls_handle_cell+0x32b) [0x5601001401cb] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.968 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(+0x115507) [0x560100186507] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.968 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(+0x10c01e) [0x56010017d01e] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.968 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(+0x52d31) [0x5601000c3d31] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.968 [ERR] Bug:     ./TorBrowser/Tor/libevent-2.1.so.6(+0x2214a) [0x7f70d3fa714a] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.968 [ERR] Bug:     ./TorBrowser/Tor/libevent-2.1.so.6(event_base_loop+0x55f) [0x7f70d3fa7c6f] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.968 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(do_main_loop+0x26c) [0x5601000c4d4c] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.968 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(tor_run_main+0x275) [0x5601000c6365] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.968 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(tor_main+0x3a) [0x5601000bf91a] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.968 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(main+0x19) [0x5601000bf669] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.968 [ERR] Bug:     /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1) [0x7f70d31532e1] (on Tor 0.3.3.9 45028085ea188baf) 
9/18/18, 17:42:12.968 [ERR] Bug:     /home/winston/tor-browser_en-US/Browser/TorBrowser/Tor/tor(+0x4e6b9) [0x5601000bf6b9] (on Tor 0.3.3.9 45028085ea188baf) 

Child Tickets

Change History (14)

comment:1 Changed 11 months ago by dgoulet

Component: - Select a componentCore Tor/Tor

This actually sounds like a missing descriptor for the IP:

node_get_curve25519_onion_key() can return NULL if no ri/md. Look in setup_introduce1_data() ... I think we might want to make that setup function be able to fail in such a case so the client can switch to a new IP.

comment:2 Changed 11 months ago by dgoulet

Status: newneeds_review

Branch ticket27774_035_01
PR: https://github.com/torproject/tor/pull/358

(Edit: scratch that branch/PR)

Last edited 11 months ago by dgoulet (previous) (diff)

comment:3 Changed 11 months ago by dgoulet

Branch: ticket27774_035_02
PR: https://github.com/torproject/tor/pull/362

comment:4 Changed 11 months ago by dgoulet

Hopefully final branch: ticket27774_035_03

(Had to make _03 to reword the commit message. The diff with _02 should be empty.)

comment:5 Changed 11 months ago by asn

Status: needs_reviewmerge_ready

LGTM!

comment:6 Changed 11 months ago by nickm

backport / no backport?

comment:7 Changed 11 months ago by dgoulet

*No* backport after consensus from me and asn. #27797 should be enough to avoid this. RARE edge case might trigger this on other tor in theory.

comment:8 Changed 11 months ago by nickm

Resolution: fixed
Status: merge_readyclosed

okay, merged to master.

comment:9 Changed 10 months ago by dgoulet

Keywords: 034-backport added
Resolution: fixed
Status: closedreopened

Someone on IRC (lattera) showed up and got it on 0.3.4.6. Here is the stacktrace:

http://ix.io/1pRy

We might want to consider a backport here imo? Flagging so we notice it.

comment:10 Changed 10 months ago by dgoulet

Milestone: Tor: 0.3.5.x-finalTor: 0.3.4.x-final

comment:11 Changed 10 months ago by nickm

If we want to backport this, we'll need a branch soon before code rot sets in.

comment:12 Changed 10 months ago by asn

Resolution: fixed
Status: reopenedclosed

We should backport #27797 since that's the root issue, whereas this is just a failsafe on top of it. Closing this and backporting #27797 instead.

comment:13 Changed 10 months ago by tor_assertion_failed_

Ha, Tor in TBB 8.0.3 has just crashed in a minute after the startup:

Tor ERR: tor_assertion_failed_(): Bug: hs_cell.c:257: introduce1_set_encrypted_onion_key: Assertion onion_pk failed; aborting. (on Tor 0.3.4.8 da95b91355248ad8) 
Tor ERR: Bug: Assertion onion_pk failed in introduce1_set_encrypted_onion_key at hs_cell.c:257. (Stack trace not available) (on Tor 0.3.4.8 da95b91355248ad8) 

Let's see how it goes with Tor 0.3.4.9.

Last edited 10 months ago by tor_assertion_failed_ (previous) (diff)

comment:14 Changed 9 months ago by asn

Yes, please reopen this bug report if you can repro this with a tor newer than tor-0.3.5.4-alpha or tor-0.3.4.9. Thanks!

Note: See TracTickets for help on using tickets.