[tor-bugs] #9601 [Obfsproxy]: Cyberoam firewall blocks obfs2/3 bridge addresses

[Tor Bug Tracker & Wiki]

#9601: Cyberoam firewall blocks obfs2/3 bridge addresses
---------------------------+-----------------
     Reporter:  Sherief    |      Owner:  asn
         Type:  task       |     Status:  new
     Priority:  normal     |  Milestone:
    Component:  Obfsproxy  |    Version:
   Resolution:             |   Keywords:
Actual Points:             |  Parent ID:
       Points:             |
---------------------------+-----------------

Comment (by Sherief):

 Replying to [comment:5 mrphs]:
 > I've just checked RT to see if the user has responded or not, here are
 some interesting logs he sent on RT:
 >
 > {{{
 > Aug 27 23:56:15.450 [Notice] Tor v0.2.4.16-rc (git-889e9bd529297284)
 > running on Windows 7 with Libevent 2.0.21-stable and OpenSSL 1.0.0k.
 > Aug 27 23:56:15.450 [Notice] Tor can't help you if you use it wrong!
 Learn
 > how to be safe at https://www.torproject.org/download/download#warning
 > Aug 27 23:56:15.450 [Notice] Read configuration file
 > "xx\Tor Browser\Data\Tor\torrc".
 > Aug 27 23:56:15.450 [Notice] Opening Socks listener on 127.0.0.1:9150
 > Aug 27 23:56:15.450 [Notice] Opening Control listener on 127.0.0.1:9151
 > Aug 27 23:56:15.450 [Notice] Parsing GEOIP IPv4 file .\Data\Tor\geoip.
 > Aug 27 23:56:15.668 [Notice] Parsing GEOIP IPv6 file .\Data\Tor\geoip6.
 > Aug 27 23:56:20.757 [Notice] Bootstrapped 5%: Connecting to directory
 > server.
 > Aug 27 23:56:21.201 [Notice] Bootstrapped 10%: Finishing handshake with
 > directory server.
 > Aug 27 23:56:22.635 [Warning] Tried connecting to router at
 > 212.112.xx:443, but identity key was not as expected: wanted
 > F2044413DAC2E02E3D6BCF4735A19BCA1DE97281 but got
 > FA00CC092639AC62C03E148F4A10C2787C129668.
 > }}}
 >
 > note the last 3 lines.
 > and then he tries adding more bridges...
 >
 > {{{
 > Aug 28 01:16:53.294 [Notice] Tor v0.2.4.16-rc (git-889e9bd529297284)
 > running on Windows 7 with Libevent 2.0.21-stable and OpenSSL 1.0.0k.
 > Aug 28 01:16:53.294 [Notice] Tor can't help you if you use it wrong!
 Learn
 > how to be safe at https://www.torproject.org/download/download#warning
 > Aug 28 01:16:53.294 [Notice] Read configuration file
 > "xx\Tor Browser\Data\Tor\torrc".
 > Aug 28 01:16:53.294 [Notice] Opening Socks listener on 127.0.0.1:9150
 > Aug 28 01:16:53.294 [Notice] Opening Control listener on 127.0.0.1:9151
 > Aug 28 01:16:53.294 [Notice] Parsing GEOIP IPv4 file .\Data\Tor\geoip.
 > Aug 28 01:16:53.509 [Notice] Parsing GEOIP IPv6 file .\Data\Tor\geoip6.
 > Aug 28 01:16:59.925 [Notice] Bootstrapped 5%: Connecting to directory
 > server.
 > Aug 28 01:17:00.017 [Notice] Bootstrapped 10%: Finishing handshake with
 > directory server.
 > Aug 28 01:17:00.784 [Notice] Learned fingerprint
 > FA00CC092639AC62C03E148F4A10C2787C129668 for bridge 109.91.xx.xx:443.
 > Aug 28 01:17:00.786 [Notice] Bootstrapped 15%: Establishing an encrypted
 > directory connection.
 > Aug 28 01:18:00.924 [Notice] No circuits are opened. Relaxed timeout for
 > circuit 2 (a General-purpose client 1-hop circuit in state doing
 handshakes
 > with channel state open) to 60000ms. However, it appears the circuit has
 > timed out anyway. 0 guards are live.
 > }}}
 >
 > Compare the fingerprints.

 Note:

 In the first log he was using obfs2/3 bridges with a PT bundle, on the
 second log he used normal bridges with the PT bundle when he should've
 used normal TBB.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9601#comment:6>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online