[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #9067 [Tor]: Choice of address and match of fascist_firewall_allows_address* need to consider ipv6
#9067: Choice of address and match of fascist_firewall_allows_address* need to
consider ipv6
-------------------------------------------+-------------------------------
Reporter: nickm | Owner: teor
Type: defect | Status: accepted
Priority: Medium | Milestone: Tor:
Component: Tor | 0.2.8.x-final
Severity: Normal | Version:
Keywords: tor-client, 025-triaged, ipv6 | Resolution:
Parent ID: #17840 | Actual Points:
Sponsor: | Points:
-------------------------------------------+-------------------------------
Comment (by teor):
Replying to [comment:13 teor]:
> Replying to [comment:5 nickm]:
> > Deferring to 0.2.6; fixing it has just as much risk for causing false
positives. (For instance, if you have a reachableaddresses policy that is
accurate for IPv4, but you have no idea what IPv6 stuff your firewall
blocks.)
>
> The only risk of false positives is if the policy contains "reject *".
> (And I can't see any way we can work around that.)
Ugh, options_validate() appends reject *:* to Reachable*Addresses.
And there's no way to work around that without either:
* never connecting to IPv6 if Reachable*Addresses has no `accept *:<port>`
entries
* always connecting to IPv6 if Reachable*Addresses only has `reject
<ipv4>:*` entries
So if ClientIPv6 is set and all Reachable*Addresses look IPv4-only, I'll
warn the user they should review their Reachable*Addresses policies.
This ticket can close when #17840 closes.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9067#comment:14>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs