[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #33241 [Core Tor/Tor]: Prop 312: 3.2.5. Use Directory Header IPv6 Addresses
#33241: Prop 312: 3.2.5. Use Directory Header IPv6 Addresses
---------------------------+------------------------------------
Reporter: teor | Owner: teor
Type: task | Status: assigned
Priority: Medium | Milestone: Tor: 0.4.4.x-final
Component: Core Tor/Tor | Version:
Severity: Normal | Resolution:
Keywords: prop312, ipv6 | Actual Points:
Parent ID: #33049 | Points: 4
Reviewer: | Sponsor: Sponsor55-must
---------------------------+------------------------------------
Comment (by teor):
Here is my opinion on this feature:
This feature is complicated. It requires relays to regularly do
directory fetches over IPv6. These directory connections should be
over an ORPort, so that the addresses are authenticated.
As an alternative, we can use IPv6 addresses from NETINFO cells. But
relays still need to make regular IPv6 ORPort connections:
https://gitweb.torproject.org/torspec.git/tree/proposals/312-relay-auto-
ipv6-addr.txt#n796
In both cases, the addresses should only come from outbound
connections. And we may only want to trust addresses from directory
authorities.
We can't make this change on bridges, because they have to imitate
clients. And clients don't try IPv4 and IPv6 connections yet. (See
proposal 306.)
This feature is also high-risk. If we make a mistake, we give network
adversaries the ability to set our IPv6 address. (But note that we
already accept this risk for IPv4.)
Overall, I think we should make this feature optional.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/33241#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs