[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #17027 [Tor]: policies_parse_exit_policy_internal should block all IPv4 and IPv6 local addresses

#17027: policies_parse_exit_policy_internal should block all IPv4 and IPv6 local
addresses
-------------------------+-------------------------------------------------
     Reporter:  teor     |      Owner:
         Type:  defect   |     Status:  needs_revision
     Priority:  major    |  Milestone:  Tor: 0.2.6.x-final
    Component:  Tor      |    Version:  Tor: unspecified
   Resolution:           |   Keywords:  TorCoreTeam201509 security
Actual Points:           |  026-backport
       Points:           |  Parent ID:
                         |    Sponsor:
-------------------------+-------------------------------------------------
Changes (by teor):

 * status:  reopened => needs_revision


Comment:

 I agree, let's backport to 0.2.6, if the required function(s) or data
 structures exist to support each address discovery method. But can we make
 the following changes first?

 In addition to blocking:
 * the configured or autodiscovered IPv4 address (Address or
 resolve_my_address()),
 * the configured IPv6 address (first IPv6 ORPort entry),
 * the publicly routable IPv4 or IPv6 address(es) of every interface on the
 server, if available.

 We could also block the following configured addresses by looking at
 OutboundBindAddressIPv4_/OutboundBindAddressIPv6_ and
 get_configured_ports():
 * OutboundBindAddress
 * ControlPort / ControlListenAddress
 * SOCKSPort / SOCKSListenAddress
 * TransPort / TransListenAddress
 * NATDPort / NATDListenAddress
 * DNSPort / DNSListenAddress
 * ORPort / ORListenAddress (IPv4 entries or subsequent IPv6 entries)
 * DirPort / DirListenAddress

 Ideally, we'd do this out of two smartlists of unique IPv4 and IPv6
 addresses, to avoid rejecting the same address multiple times. Duplicates
 will be removed by exit_policy_remove_redundancies() in any case.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17027#comment:18>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs