[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #17975 [Core Tor/Tor]: Introduce OutboundExitAddress to enable exit-only traffic to go via a different IP address
#17975: Introduce OutboundExitAddress to enable exit-only traffic to go via a
different IP address
-------------------------------------------------+-------------------------
Reporter: naif | Owner:
Type: enhancement | Status:
| needs_revision
Priority: Low | Milestone: Tor:
| 0.3.0.x-final
Component: Core Tor/Tor | Version:
Severity: Normal | Resolution:
Keywords: lorax, yawning, isaremoved, review- | Actual Points:
group-11 |
Parent ID: | Points: 1
Reviewer: | Sponsor:
-------------------------------------------------+-------------------------
Comment (by michaelsonntag):
* parse_outbound_address is complicated, because it is complex. All cases
are different. There is the (old) general option affecting both OR and
exit traffic, as well as the separation between IPv4 and IPv6 and the
random sequence any of these options may appear. Therefore I don't think
factoring out is really going to be useful (e.g. checking for no duplicate
settings and providing helpful error messages while checking for one/two
conflicting options). The "adr_found" array could be changed to a two-
dimensional array with constants as index (OR, EXIT; IPv4, IPv6) - this
would render it extensions easier.
* conn_get_outbound_address falls back to the exit address if OR is null,
because the user explicitly specified something, so this should be honored
(better something than nothing). But it can also be left to the default
address.
* Other outbound connection types: the following seem to exist:
#define CONN_TYPE_OR_LISTENER 3
#define CONN_TYPE_OR 4
These are relay connections, so should not be sent over the "exit"
interface
#define CONN_TYPE_EXIT 5
Actual exit connection, should use the "exit" interface
#define CONN_TYPE_AP_LISTENER 6
#define CONN_TYPE_AP 7
Socks proxy connections. This is "input" and should therefore not use the
"exit" interface.
#define CONN_TYPE_DIR_LISTENER 8
#define CONN_TYPE_DIR 9
Directory server, i.e. internal communication going into this or another
node. It should not use the "exit" interface.
#define CONN_TYPE_CONTROL_LISTENER 11
#define CONN_TYPE_CONTROL 12
Connection to a user interface - should be locally only and is definitely
not "exit" traffic.
#define CONN_TYPE_AP_TRANS_LISTENER 13
#define CONN_TYPE_AP_NATD_LISTENER 14
Traffic redirected into tor, so incoming connections and should not use
the "exit" interface.
#define CONN_TYPE_AP_DNS_LISTENER 15
Listen for DNS requests from clients; like SOCKS so no exit traffic.
#define CONN_TYPE_EXT_OR 16
#define CONN_TYPE_EXT_OR_LISTENER 17
Relay connections, should not be sent over the "exit" interface
* DNS request nameservers seem to be configured in or/dns.c:1355
(configure_nameservers). However, in my configuration I could not find any
position where HAVE_EVDNS_SET_DEFAULT_OUTGOING_BIND_ADDRESS is set/defined
(remnant of old library?). Generally: DNS requests are problematic. The
local host or some internal server might be used for DNS resolving. Then
another option for configuring DNS would be necessary, as these may not be
reachable from the "exit" interface.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17975#comment:13>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs