Anondate.mw

{{Header}}
{{#seo:
|description=extracting time from Tor consensus
}}
{{intro|
extracting time from Tor consensus
}}

= anondate-get =
Diagnostic utility. <code>anondate-<u>get</u></code>. A higher level and easier to use tool than the lower level <code>anondate</code>.

Usage of <code>anondate-get</code> should be safe. It does not use networking. It does not change the time. It only looks at locally available information.

{{CodeSelect|code=
sudo anondate-get
}}

Sample output.

<pre>
/usr/sbin/anondate-get: INFO: 100% Tor bootstrap, ok.
/usr/sbin/anondate-get: INFO: tor_circuit_established_check.py, ok.
/usr/sbin/anondate-get: INFO: Tor circuit already established, ok.
/usr/sbin/anondate-get: INFO: current time in valid in range, ok.
/usr/sbin/anondate-get: INFO: Tor certificate lifetime valid, ok.
/usr/sbin/anondate-get: END: Exiting with exit_code '3' indicating 'Could not determine any time using Tor from consensus or certificate life time.'.
</pre>

= anondate-set =
Security impact has yet to be documented.

<code>anondate-<u>set</u></code>.

{{CodeSelect|code=
sudo anondate-set
}}

<pre>
/usr/sbin/anondate-set: INFO: Status file '/run/anondate/tor_certificate_lifetime_set' does not yet exist.
/usr/sbin/anondate-set: INFO: running anondate-get...
/usr/sbin/anondate-get: INFO: 100% Tor bootstrap, ok.
/usr/sbin/anondate-get: INFO: tor_circuit_established_check.py, ok.
/usr/sbin/anondate-get: INFO: Tor circuit already established, ok.
/usr/sbin/anondate-get: INFO: current time in valid in range, ok.
/usr/sbin/anondate-get: INFO: Tor certificate lifetime valid, ok.
/usr/sbin/anondate-get: END: Exiting with exit_code '3' indicating 'Could not determine any time using Tor from consensus or certificate life time.'.
/usr/sbin/anondate-set: END: Exiting with exit_code '3' indicating 'Setting time using anondate either not possible or not required.'.
</pre>

= anondate =
===== Introduction =====

* TODO: documentation on anondate is outdated
* The anondate interface description as per the latest git master:
* {{Github_link|
https://github.com/Kicksecure/helper-scripts/blob/master/usr/sbin/anondate
}}
* See also: [[#Tor Consensus Method]]
* Needs access to either:
** <code>/var/run/tor/log</code> (default only in {{project_name_long}}).  [Tor Project upstream feature request: [https://gitlab.torproject.org/legacy/trac/-/issues/16821 additional /var/run/tor/log default log]] This is preferable because it contains only Tor's log since the last boot, which is more relevant and easier for <code>anondate</code> to parse.
** Or access to <code>/var/log/tor/log</code>. This is configurable through the environment variable <code>TOR_LOG</code> (<code>export TOR_LOG=/var/log/tor/log</code>). (Alternatively, we could change the default in the code.)

===== Consensus Related Options =====

* <code>--verified-only</code>
* <code>--prefer-verified</code>
* <code>--unverified-only</code>

===== Special Exit Codes =====
* exit <code>3</code>: <code>$TOR_LOG</code> not readable.
* exit <code>4</code>: <code>$consensus</code> not readable.

===== Simple Status Checking =====
====== anondate --has-consensus ======

Useful for checking whether requesting any of the [[#Date Ranges Output]] values is worthwhile.

* yes:
** exit <code>0</code>
* no:
** exit <code>1</code>
<br />
Could be replaced by Tor ControlPort / python-stem?

* verified-only: Yes. (<code>consensus/valid-after</code>)
* unverified: No.

====== anondate --current-time-in-valid-range ======

Useful as a sanity test before setting the time for the first time and before updating it with a newly fetched timestamp.

* yes:
** exit <code>0</code>
* no:
** exit <code>1</code>
<br />
Could be replaced by Tor ControlPort / python-stem?

* verified-only: Yes. (See below.)
* unverified: No. Tor Project upstream feature request: [https://gitlab.torproject.org/legacy/trac/-/issues/16845 make unverified consensus ISOTime accessible through Tor's ControlPort]

===== Date Ranges Output =====
====== anondate --show-valid-after ======

* yes:
** output: <code>2015-08-15 22:00:00</code>
** exit <code>0</code>
* no:
** exit <code>1</code>
<br />
Could be replaced by Tor ControlPort / python-stem?

* verified-only: Yes. <code>consensus/valid-after</code>
* unverified: No. Tor Project upstream feature request: [https://gitlab.torproject.org/legacy/trac/-/issues/16845 make unverified consensus ISOTime accessible through Tor's ControlPort]

====== anondate --show-valid-until ======

* yes:
** output: <code>2015-08-16 01:00:00</code>
** exit <code>0</code>
* no:
** exit <code>1</code>
<br />
Could be replaced by Tor ControlPort / python-stem?

* verified-only: Yes. <code>consensus/valid-until</code>
* unverified: No. Tor Project upstream feature request: [https://gitlab.torproject.org/legacy/trac/-/issues/16845 make unverified consensus ISOTime accessible through Tor's ControlPort]

====== anondate --show-middle-range ======

* yes:
** output: <code>2015-08-15 23:30:00</code>
** exit <code>0</code>
* no:
** exit <code>1</code>
<br />
(A scripted calculation of the above.)

===== Certificate Validity =====
When the clock is several months or years fast or slow, Tor cannot even download the Tor consensus. Tor, however, should always provide a certificate lifetime. For a security discussion, see also [[Dev/TimeSync#Tor_Certificate_Lifetime|Tor Certificate Lifetime]].

====== anondate --tor-cert-lifetime-valid ======
<pre>
Sep 03 10:32:59.000 [warn] Certificate already expired. Either their clock is set wrong, or your clock is wrong.
Sep 03 10:32:59.000 [warn] (certificate lifetime runs from Aug 16 00:00:00 2014 GMT through Jul 29 23:59:59 2015 GMT. Your time is Sep 03 10:32:59 2015 UTC.)
</pre>

* yes:
** output: <code>Sep 03 10:34:00.000 [warn] Certificate already expired. Either their clock is set wrong, or your clock is wrong.</code>
** exit <code>0</code>
* no:
** exit <code>1</code>

Could this be replaced by Tor ControlPort / python-stem? No. Tor Project upstream feature request: [https://gitlab.torproject.org/legacy/trac/-/issues/16822 make certificate lifetime accessible through Tor's ControlPort]

====== anondate --tor-cert-valid-after ======

Similar to the above, but provides less output.

* output: <code>Jun 16 00:00:00 2014 GMT</code>
* Exit codes unreliable.
* Don't use without invoking the above first.
* (Could be fixed in the code if worthwhile.)

{{Footer}}

[[Category:Development]]