Connection to some obfs4 bridges fails on fresh installation

Summary

Some obfs4 bridges don't work on fresh installations of TorBrowsers

Steps to reproduce:

If I have a fresh installation of Tor Browser and I try to set an obfs4 bridge

What is the current bug behavior?

I might (non-deterministically, but with high probability) have problems

• the connection progress bar gets stuck at ~75%
• waiting does not help
• pressing cancel and retrying solves the problem.

I couldn't reproduce it on a TorBrowser which already connected to Tor in the past.

This is the same problem we found at Tails. In our issue there are more details about it.

Not every obfs4 bridge have this problem, but many do. I can share specific addresses if that's useful, but I think you'll have no problem finding bridges that have this behavior.

What is the expected behavior?

It should just connect

Environment

• Debian stable
• Installed from tarball from https://www.torproject.org/download/

changed the description

@boyska is this with 11.5.x, right?

Do you have some logs?

Also, we're updating obfs4 with the next versions, but I don't know if this will help.

@boyska is this with 11.5.x, right?

yes

Do you have some logs?

they are at https://gitlab.tails.boum.org/tails/tails/-/issues/19173

Also, we're updating obfs4 with the next versions, but I don't know if this will help.

we'll see

I have reproduced the issue against a bridge with obfs4 < 0.0.12 and not with >= 0.0.12. I believe this issue is #40804 (closed). The problem is not in TB, I have reproduced it with tor directly. When there is no previous DataDirectory and we hit #40804 (closed) tor gets stuck:

Nov 22 13:54:06.000 [notice] Bootstrapped 77% (ap_conn_done_pt): Connected to pluggable transport to build circuits
Nov 22 13:54:07.000 [warn] Proxy Client: unable to connect OR connection (handshaking (proxy)) with xx.xx.xx.xx:xxx ID=xxxxxxxxxxx RSA_ID=xxxxxxx ("general SOCKS server failure")
Nov 22 13:54:07.000 [notice] Delaying directory fetches: No running bridges

On a second run, with an already existing DataDirectory, it does connect. I have reproduced this behavior several times by removing the DataDirectory.

I'm doing my best to get bridges to update (https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/obfs4/-/issues/40008), but is taking some time.

@ahf should we open an issue on tpo/core/tor (or move this one)?

@meskio Hm, you can open a ticket, yes, but am I reading this right that the PT assumes the DataDirectory is there? I don't get what has changed between obfs4 0.0.12 and after that could impact that?

@ahf The difference between obfs4 0.0.12 and after is that there was a change that was not completely backward compatible and sometimes obfs4 will fail to connect and needed to retry. It looks like tor on a fresh environment without DataDir will not retry the connection and will require to be restarted, once the DataDir is present it does the right thing and do retry properly.

I have try to reproduce that issue connecting to non existing bridges, but it looks like it only happens when 77% of the bootstrap has worked (there was a connection stablished but the bridge has failed) and not in other cases. Having most bridges and clients already upgraded this problem should not be present for most of the people. I think we can ignore it and look into arti for fixes on those kind of corner cases.

@boyska are you ok if we close this issue for now?

@meskio given "most bridges already upgraded" (haven't checked but I trust you), sure, go ahead

Maybe @meskio has some idea about this?

added Anti-Censorship Backlog Bug labels

I will need logs to see the problem. I can try to reproduce it myself, but not sure when. So logs will speed up the process.

I don't expect the upgrade of obfs4 to change much here, as the protocol changes should be backward compatible, but maybe there are surprises here.

@boyska has this issue resolved itself for you?

@richard I think you can close this issue (see the thread above).

removed Backlog label

added Roadmap::Future label

added All Platforms label

closed