[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #12208 [Obfuscation/meek]: Make it possible to use an IP address as a front (no DNS request and no SNI)

#12208: Make it possible to use an IP address as a front (no DNS request and no
SNI)
------------------------------+------------------------------
 Reporter:  dcf               |          Owner:  dcf
     Type:  enhancement       |         Status:  needs_review
 Priority:  Medium            |      Milestone:
Component:  Obfuscation/meek  |        Version:
 Severity:  Normal            |     Resolution:
 Keywords:                    |  Actual Points:
Parent ID:                    |         Points:
 Reviewer:                    |        Sponsor:
------------------------------+------------------------------

Comment (by dcf):

 Here are the four use cases I want to support. Cases !#1 and !#2 are
 already supported; this ticket is about adding !#3 and !#4. In the table,
 I separated `urlName` into "DNS name" and "connect to".
  * cdn.ex is at IP address 1.2.3.4
    * serves a default certificate for CN=cdn.ex in absence of SNI
  * meek.ex is at IP address 5.5.5.5

 ||   ||                ||= DNS query =||= connect to =||= `hostName` =||=
 `sniName` =||= `verifyName` =||
 ||!#1||          direct|| meek.ex     || 5.5.5.5      || meek.ex      ||
 meek.ex     || meek.ex        ||
 ||!#2|| domain fronting|| cdn.ex      || 1.2.3.4      || meek.ex      ||
 cdn.ex      || cdn.ex         ||
 ||!#3||     DNS, no SNI|| cdn.ex      || 1.2.3.4      || meek.ex      ||
 ^''none''^  || cdn.ex         ||
 ||!#4||  no DNS, no SNI|| ^''none''^  || 1.2.3.4      || meek.ex      ||
 ^''none''^  || cdn.ex         ||

 meek-client takes its configuration in two ways: on a per-connection basis
 via [https://gitweb.torproject.org/torspec.git/tree/pt-
 spec.txt?id=86480728d816474a0771a3b3aba5d223a32f0705#n628 PT SOCKS
 arguments], or globally via [https://gitweb.torproject.org/pluggable-
 transports/meek.git/tree/doc/meek-
 client.1.txt?id=7243a0df885dda442750836b397c2c5d1c7f3e8a#n61 command-line
 options]. SOCKS arguments take precedence over command-line options. Here
 is how cases !#1 and !#2 are represented:

 === !#1 direct
  SOCKS args::
   `url=https://meek.ex/`
  command line::
   `-url https://meek.ex/`
 === !#2 domain fronting
  SOCKS args::
   `url=https://meek.ex/ front=cdn.ex`
  command line::
   `-url https://meek.ex/ -front cdn.ex`

 We have to decide how to represent use cases !#3 and !#4.

 Observations:
  * `hostName` is the name of the final destination, always.
    * It comes from the `url` argument and I like that design.
  * The only time `sniName`≠`verifyName` is when `sniName`=''none''.
    * That is, there's no need to control `sniName` and `verifyName`
 completely independently, only for an option to blank the `sniName`.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/12208#comment:17>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online

_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs