[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #28525 [Core Tor/Tor]: Make tor_addr_is_internal_() aware of RFC 6598 (Carrier Grade NAT/Large Scale NAT) IPv4 Ranges
#28525: Make tor_addr_is_internal_() aware of RFC 6598 (Carrier Grade NAT/Large
Scale NAT) IPv4 Ranges
-------------------------------------------------+-------------------------
Reporter: neel | Owner: neel
Type: defect | Status:
| needs_revision
Priority: Medium | Milestone: Tor:
| 0.4.1.x-final
Component: Core Tor/Tor | Version:
Severity: Normal | Resolution:
Keywords: ipv6, 040-deferred-20190220, | Actual Points:
040-backport, 035-backport, 034-backport, |
029-backport, security-low |
Parent ID: | Points:
Reviewer: nickm, teor | Sponsor:
-------------------------------------------------+-------------------------
Changes (by teor):
* status: needs_review => needs_revision
* cc: teor (removed)
* milestone: Tor: unspecified => Tor: 0.4.1.x-final
* keywords: ipv6, 040-deferred-20190220 =>
ipv6, 040-deferred-20190220, 040-backport, 035-backport, 034-backport,
029-backport, security-low
* reviewer: nickm => nickm, teor
* type: enhancement => defect
Comment:
It seems ok to me.
It's a bit weird that we don't list 0.0.0.0 in the list of internal
addresses. But no sensible OS will try to connect to it anyway, so that
doesn't really matter. (And if we want to fix 0.0.0.0, we should do it in
another ticket.)
This patch mitigates some security issues created by RFC 6598 by:
* blocking control ports on RFC 6598 addresses
* warning when client ports and ExtORPorts are on RFC 6598 addresses
(Despite our earlier comments, we don't currently block or warn on RFC
6598 addresses.)
So I'm marking it for possible backport.
Here's what we should do before we merge:
* update the changes file to describe these major, user-visible security
changes
* squash and cherry-pick to maint-0.2.9
neel, are you ok making these changes?
Just let us know if you can't, and someone will do it eventually.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/28525#comment:22>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs