nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-01 08:03:31 +01:00
Code Issues Packages Projects Releases Wiki Activity
7e9532b9be
tor/scripts/maint/fallback.blacklist

222 lines
12 KiB
Plaintext
Raw Normal View History

Add Fallback Directory Candidate Selection Script "Tor has included a feature to fetch the initial consensus from nodes other than the authorities for a while now. We just haven't shipped a list of alternate locations for clients to go to yet. Reasons why we might want to ship tor with a list of additional places where clients can find the consensus is that it makes authority reachability and BW less important. We want them to have been around and using their current key, address, and port for a while now (120 days), and have been running, a guard, and a v2 directory mirror for most of that time." Features: * whitelist and blacklist for an opt-in/opt-out trial. * excludes BadExits, tor versions that aren't recommended, and low consensus weight directory mirrors. * reduces the weighting of Exits to avoid overloading them. * places limits on the weight of any one fallback. * includes an IPv6 address and orport for each FallbackDir, as implemented in #17327. (Tor won't bootstrap using IPv6 fallbacks until #17840 is merged.) * generated output includes timestamps & Onionoo URL for traceability. * unit test ensures that we successfully load all included default fallback directories. Closes ticket #15775. Patch by "teor". OnionOO script by "weasel", "teor", "gsathya", and "karsten".
2015-05-12 20:10:39 +02:00
# updateFallbackDirs.py directory mirror blacklist
#
# Format:
# [ IPv4[:DirPort] ] [ orport=<ORPort> ] [ id=<ID> ] ...
# [ ipv6=<IPv6>[:<IPv6 ORPort>] ]
#
# If a sufficiently specific group of attributes matches, the directory mirror
# will be excluded: (each group is listed on its own line)
# <IPv4>, <DirPort>
# <IPv4>, <ORPort>
# <ID>
# <IPv6>, <DirPort>
# <IPv6>, <IPv6 ORPort>
# If DirPort and ORPort are not present, the entire IP address is blacklisted.
# (The blacklist overrides the whitelist.)
# If a relay operator doesn't want their relay to be a FallbackDir,
# enter the following information here:
# <IPv4>:<DirPort> orport=<ORPort> id=<ID> ipv6=<IPv6>:<IPv6 ORPort>
Add default fallback directories for the 0.2.8 alpha releases Allow fallback directories which have been stable for 30 days to work around #18050, which causes relays to submit descriptors with 0 DirPorts when restarted. (Particularly during Tor version upgrades.) Ignore low fallback directory count in alpha builds.
2016-01-18 02:34:34 +01:00
# https://lists.torproject.org/pipermail/tor-relays/2015-December/008364.html
87.181.248.227:9030 orport=443 id=8827944C4BDCBDAC9079803F47823403C11A9B7A
# https://lists.torproject.org/pipermail/tor-relays/2015-December/008368.html
149.18.2.82:9030 orport=9001 id=953DB709F2A2DECC8D7560661F934E64411444F7
# https://lists.torproject.org/pipermail/tor-relays/2015-December/008384.html
80.82.215.199:80 orport=443 id=3BEFAB76461B6B99DCF34C285E933562F5712AE4 ipv6=[2001:4ba0:cafe:a18::1]:443
# https://lists.torproject.org/pipermail/tor-relays/2016-January/008515.html
# later opt-out in
# https://lists.torproject.org/pipermail/tor-relays/2016-January/008521.html
5.9.158.75:80 orport=443 id=F1BE15429B3CE696D6807F4D4A58B1BFEC45C822 ipv6=[2a01:4f8:190:514a::2]:443
# Email sent directly to teor, verified using relay contact info
5.34.183.168:80 orport=443 id=601C92108A568742A7A6D9473FE3A414F7149070
217.12.199.208:8080 orport=22 id=BCFB0933367D626715DA32A147F417194A5D48D6
# https://lists.torproject.org/pipermail/tor-relays/2016-January/008555.html
62.210.207.124:9030 orport=9001 id=58938B1A5C4029B4415D38A4F36B7724273F4755 ipv6=[2001:bc8:31eb:100::1]:9001
62.210.207.124:9130 orport=9101 id=338D0AB6DBAB7B529B9C91B2FD770658000693C4 ipv6=[2001:bc8:31eb:100::1]:9101
Add fallbacks to white/blacklist from operator responses Also add misbehaving relays to updateFallbackDirs.py blacklist, but leave them commented out in case it's a transient issue, or it's been resolved by the download check fixes. (These relays hang stem's downloader. It's unlikely they'll ever help clients.)
2016-03-31 00:19:50 +02:00
# these fallback candidates fail the consensus download test in a way that
# causes stem to hang (and not respond to ^C, at least on OS X)
# (Is something sending weird responses to DirPort traffic?)
#217.23.14.190:1194
#151.80.164.147:80
#148.251.255.92:80
#78.142.19.59:80
# Email sent directly to teor, verified using relay contact info
216.17.99.183:80 orport=443 id=D52CD431CEF28E01B11F545A84347EE45524BCA7
216.17.99.183:8080 orport=9001 id=EE21F83AB6F76E3B3FFCBA5C2496F789CB84E7C6
65.19.167.130:80 orport=443 id=890E2EA65455FBF0FAAB4159FAC4412BDCB24295
65.19.167.131:80 orport=443 id=0DA9BD201766EDB19F57F49F1A013A8A5432C008
65.19.167.132:80 orport=443 id=12B80ABF019354A9D25EE8BE85EB3C0AD8F7DFC1
65.19.167.133:80 orport=443 id=C170AE5A886C5A09D6D1CF5CF284653632EEF25D
# Email sent directly to teor, verified using relay contact info
213.136.83.225:80 orport=443 id=B411027C926A9BFFCF7DA91E3CAF1856A321EFFD
195.154.126.78:80 orport=443 id=F6556156E2B3837248E03FDB770441CF64DBBFBE
# Email sent directly to teor, verified using relay contact info
178.63.198.113:80 orport=443 id=872B18761953254914F77C71846E8A2623C52591
# Email sent directly to teor, verified using relay contact info
63.141.226.34:80 orport=9001 id=5EF131C0C82270F40B756987FDB5D54D9C966238
185.75.56.103:80 orport=9001 id=3763CE5C3F574670D4296573744F821C0FFFB98E
# Email sent directly to teor, verified using relay contact info
81.7.14.227:9030 orport=9001 id=BCA197C43A44B7B9D14509637F96A45B13C233D0
# Email sent directly to teor, verified using relay contact info
84.245.32.195:9030 orport=9001 id=4CD4DFFEF3971C902A22100D911CAC639BE2EF5C
# Email sent directly to teor, verified using relay contact info
185.21.217.10:9030 orport=9001 id=41537E1D3DD3CAE86F5A3F0882F1C647FE8FC0A0
# Email sent directly to teor, verified using relay contact info
185.21.216.140:9030 orport=9001 id=921DA852C95141F8964B359F774B35502E489869
# Email sent directly to teor, verified using relay contact info
62.210.82.44:143 orport=21 id=1C90D3AEADFF3BCD079810632C8B85637924A58E ipv6=[2001:bc8:3d7c::]:21
# Email sent directly to teor, verified using relay contact info
46.101.220.161:80 orport=443 id=7DDFE5B2C306B19A79832FBE581EAA245BAE90C6 ipv6=[2a03:b0c0:3:d0::8b:3001]:443
# Email sent directly to teor, verified using relay contact info
195.154.107.23:80 orport=443 id=A1F89F26E82209169E4037B035AE7B6C94A49AEB ipv6=[2001:bc8:3829:300::1]:443
195.154.92.70:80 orport=443 id=E7FF4ECEEFCFE3A40A6D3594898A4A3DE018BBF5 ipv6=[2001:bc8:3829:500::1]:443
195.154.113.200:80 orport=443 id=D1A4763FA0BD71978901B1951FEE1DC29777F95A ipv6=[2001:bc8:3829:600::1]:443
195.154.92.155:110 orport=993 id=4477D3466FE136B7FE6F7FF8EBD0D6E2FFE3288B ipv6=[2001:bc8:3829:100::1]:993
195.154.117.182:110 orport=993 id=B1A0F1143789466AADD5FAE5948C8138548EECEC ipv6=[2001:bc8:3829:400::1]:993
195.154.97.163:80 orport=443 id=8A2994A63B20813B7724817A8FB8C444D10BA2E2
# Email sent directly to teor, verified using relay contact info
5.135.154.206:9030 orport=9001 id=7D67B342DC1158F4CFFEE8BC530A2448848026E3
# Email sent directly to teor, verified using relay contact info
85.24.215.117:9030 orport=9001 id=5989521A85C94EE101E88B8DB2E68321673F9405 ipv6=[2001:9b0:20:2106:21a:4aff:fea5:ad05]:9001
# Email sent directly to teor, verified using relay contact info
62.210.137.230:8888 orport=8843 id=CD6B850159CFF4C068A8D0F1BA5296AE4EDCAB39 ipv6=[2001:bc8:31d3:100::1]:3443
62.210.137.230:8080 orport=8443 id=F596E1B1EF98E1DDBBDC934DB722AF54069868F6 ipv6=[2001:bc8:31d3:100::1]:8443
# Email sent directly to teor, verified using relay contact info
195.154.99.80:80 orport=443 id=6E7CB6E783C1B67B79D0EBBE7D48BC09BD441201
195.154.127.60:80 orport=443 id=D74ABE34845190E242EC74BA28B8C89B0A480D4B
# Email sent directly to teor, verified using relay contact info
212.51.143.20:80 orport=443 id=62DA0256BBC28992D41CBAFB549FFD7C9B846A99
# Email sent directly to teor, verified using relay contact info
195.154.90.122:80 orport=443 id=3A0D88024A30152E6F6372CFDF8F9B725F984362
# Email sent directly to teor, verified using relay contact info
188.166.118.215:9030 orport=443 id=FB5FF60F5EBA010F8A45AC6ED31A4393718A2C31 ipv6=[2a03:b0c0:2:d0::72:9001]:443
# Email sent directly to teor, verified using relay contact info
185.87.185.245:40001 orport=40000 id=2A499AEEA95FB10F07544383D562368E49BE32CA
# Email sent directly to teor, verified using relay contact info
82.161.109.71:9030 orport=9001 id=BD9CE352648B940E788A8E45393C5400CC3E87E7
# Email sent directly to teor, verified using relay contact info
212.83.40.239:9030 orport=9001 id=6DC5616BD3FC463329DCE87DD7AAAEA112C264B5
# Email sent directly to teor, verified using relay contact info
178.32.53.53:80 orport=443 id=10582C360E972EE76B0DB1C246F4E892A6BF5465
# Email sent directly to teor, verified using relay contact info
85.114.135.20:9030 orport=9001 id=ED8A9291A3139E34BBD35037B082081EC6C26C80 ipv6=[2001:4ba0:fff5:2d::8]:9001
148.251.128.156:9030 orport=9001 id=E382042E06A0A68AFC533E5AD5FB6867A12DF9FF ipv6=[2a01:4f8:210:238a::8]:9001
62.210.115.147:9030 orport=9001 id=7F1D94E2C36F8CC595C2AB00022A5AE38171D50B ipv6=[2001:bc8:3182:101::8]:9001
212.47.250.24:9030 orport=9001 id=33DA0CAB7C27812EFF2E22C9705630A54D101FEB
# Email sent directly to teor, verified using relay contact info
74.208.220.222:60000 orport=59999 id=4AA22235F0E9B3795A33930343CBB3EDAC60C5B0
# Email sent directly to teor, verified using relay contact info
89.163.140.168:9030 orport=9001 id=839C1212DB15723263BE96C83DA7E1B24FA395E8
# Email sent directly to teor, verified using relay contact info
212.47.246.211:9030 orport=9001 id=AA34219475E41282095DD3C088009EE562AF14E5
# Email sent directly to teor, verified using relay contact info
85.195.235.148:9030 orport=9001 id=103336165A0D2EFCAD3605339843A0A7710B8B92
85.195.235.148:19030 orport=19001 id=713235638AB6C64715EAFD1B4772685E38AFD52A
# Email sent directly to teor, verified using relay contact info
163.172.7.30:9030 orport=9001 id=E2EACD4752B2583202F374A34CACC844A3AECAC4
# Email sent directly to teor, verified using relay contact info
178.62.90.111:22 orport=25 id=3254D1DC1F1531D9C07C535E4991F38EE99B99E1
# Email sent directly to teor, verified using relay contact info
213.200.106.131:9030 orport=4443 id=B07CE79FD215129C381F6645B16E76DCA0845CAB
# Email sent directly to teor, verified using relay contact info
198.51.75.165:80 orport=9001 id=DABCB84A524A22FDDD3AFCB090E3090CC12D9770
# Email sent directly to teor, verified using relay contact info
204.194.29.4:80 orport=9001 id=78C7C299DB4C4BD119A22B87B57D5AF5F3741A79
# Email sent directly to teor, verified using relay contact info
104.207.132.109:9030 orport=9001 id=12D5737383C23E756A7AA1A90BB24413BA428DA7 ipv6=[2001:19f0:300:2261::1]:9001
Whitelist additional fallbacks after creating April 2016 list
2016-04-18 14:20:06 +02:00
# Email sent directly to teor, verified using relay contact info
46.252.25.249:9030 orport=443 id=80DCBB6EF4E86A7CD4FBCBDEE64979645509A610
# Email sent directly to teor, verified using relay contact info
176.10.99.200:8080 orport=443 id=2B44FD1742D26E4F28D4CACF1F0CF8A686270E45
176.10.99.200:8000 orport=22 id=EB79F07792A065D3C534063773E83268E069F5EB
176.10.99.201:667 orport=666 id=3EAAAB35932610411E24FA4317603CB5780B80BC
176.10.99.201:990 orport=989 id=7C3A4CFF09C1981D41173CDE2A2ADD4A5CA109FD
176.10.99.202:992 orport=991 id=615EBC4B48F03858FA50A3E23E5AF569D0D2308A
176.10.99.202:994 orport=993 id=E34E25D958D46DDE5092385B14117C9B301DC0E9
176.10.99.203:1194 orport=995 id=AD368442E9FF33C08C7407DF2DA7DB958F406CE2
176.10.99.203:43 orport=53 id=79CF377F0ACEC5F0002D85335E4192B34202A269
176.10.99.204:1755 orport=1723 id=69DF3CDA1CDA460C17ECAD9D6F0C117A42384FA0
176.10.99.204:1293 orport=4321 id=3F061400B6FB1F55E7F19BB3C713884D677E55B7
176.10.99.205:426 orport=425 id=C30B284784BF11D0D58C6A250240EE58D2084AD0
176.10.99.205:109 orport=110 id=12D17D9F9E30FA901DE68806950A0EA278716CED
176.10.99.206:24 orport=23 id=2C804AAB0C02F971A4386B3A1F2AC00F9E080679
176.10.99.206:20 orport=21 id=237588726AB6BEA37FF23CA00F5BD178586CA68E
176.10.99.207:3390 orport=3389 id=A838D5B8890B10172429ECE92EB5677DF93DC4DD
176.10.99.207:1415 orport=1414 id=377E5E817A84FAE0F4DC3427805DB2E8A6CBBFC0
176.10.99.208:390 orport=389 id=7C288587BA0D99CC6B8537CDC2C4639FA827B907
176.10.99.208:3307 orport=3306 id=1F0D2A44C56F42816DED2022EFD631878C29905B
176.10.99.209:1434 orport=1433 id=BDA7A91FF3806DE5109FDAE74CFEFB3BABB9E10F
176.10.99.209:220 orport=219 id=B8C2030001D832066A648269CFBA94171951D34B
Update the fallback whitelist and blacklist Operators have sent emails asking to have their relays added or removed from the fallback list. Since none of the blacklisted relays are in the hard-coded falback list, it does not need to be changed.
2016-04-28 13:37:19 +02:00
# Email sent directly to teor, verified using relay contact info
78.193.40.205:8080 orport=8443 id=C91450840E75AC1B654A3096744338A573A239C6
# Email sent directly to teor, verified using relay contact info
37.187.22.172:9030 orport=9035 id=335E4117BD9A4966403C2AFA31CFDD1BC13BD46A
# https://lists.torproject.org/pipermail/tor-relays/2015-December/008367.html
# Email sent directly to teor to opt-out
88.198.38.226:22 orport=443 id=4B9E2C56FB42B891794FE2CD2FCAD08A320CC3BB ipv6=[2a01:4f8:a0:1351::2]:80
213.239.210.204:22 orport=443 id=5BFDECCE9B4A23AE14EC767C5A2C1E10558B00B9 ipv6=[2a01:4f8:a0:9474::2]:80
213.239.220.25:22 orport=443 id=BEE2317AE127EB681C5AE1551C1EA0630580638A ipv6=[2a01:4f8:a0:710c::2]:80
85.10.201.38:22 orport=443 id=F6279A203C1950ACF592322A235647A05BFBCF91 ipv6=[2a01:4f8:a0:43cc::2]:80
# Email sent directly to teor, verified using relay contact info
88.190.208.4:30555 orport=30556 id=030A6EB24725C05D8E0FCE21923CBA5223E75E0E
Remove and blacklist 4 fallbacks which are unsuitable Remove a fallback that changed its fingerprint after it was listed This happened after to a software update: https://lists.torproject.org/pipermail/tor-relays/2016-June/009473.html Remove a fallback that changed IPv4 address Remove two fallbacks that were slow to deliver consensuses, we can't guarantee they'll be fast in future. Blacklist all these fallbacks until operators confirm they're stable.
2016-06-22 01:59:05 +02:00
# Fallback was on 0.2.8.2-alpha list, but changed fingerprint before 0.2.8.5
46.101.102.71:80 orport=443 id=9504CB22EEB25D344DE63CB7A6F2C46F895C3686 ipv6=[2a03:b0c0:3:d0::2ed:7001]:9050
# Also blacklist anything with the new fingerprint
id=9C8A123081EFBE022EF795630F447839DDFDDDEC
# Fallbacks were on 0.2.8.2-alpha list, but downloads were slow before 0.2.8.5
185.96.88.29:80 orport=443 id=86C281AD135058238D7A337D546C902BE8505DDE
178.62.36.64:9030 orport=9001 id=B87C84E38DAECFFFFDE98E5AEE5786AFDC748F2C
# Fallback was on 0.2.8.2-alpha list, but changed address before 0.2.8.5
84.219.173.60:9030 orport=443 id=855BC2DABE24C861CD887DB9B2E950424B49FC34
# Also blacklist anything with the new address
84.216.235.55:9030 orport=443
Reference in New Issue Copy Permalink