[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #17901 [Core Tor/Tor]: Tor would bind ControlPort to public ip address if it has no localhost interface
#17901: Tor would bind ControlPort to public ip address if it has no localhost
interface
-------------------------------------------------+-------------------------
Reporter: s7r | Owner: (none)
Type: defect | Status: new
Priority: High | Milestone: Tor:
| unspecified
Component: Core Tor/Tor | Version: Tor:
| 0.2.6.10
Severity: Major | Resolution:
Keywords: tor-control misconfiguration | Actual Points:
security easy |
Parent ID: | Points: 3
Reviewer: | Sponsor:
-------------------------------------------------+-------------------------
Comment (by fristonio):
If I got the issue right then, since ControlPort offers total control over
tor we should not let it bind when the port is publicly exposed or when
there is no loopback interface available. So to implement this we need to
use the functions attached here by teor and then check if loopback address
is available when we bind ControlPort using these functions, and close tor
if check fails with a warning that it is dangerous.
Can I work on this?
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17901#comment:45>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs