Malicious relays may be able to be assigned Exit flag without exiting anywhere
The IANA for Multicast addresses indicates there are many /8's that are not yet allocated[0], such as 232.0.0.0-232.255.255.255.
The current voting mechanism in exit_policy_is_general_exit_helper allows an Exit flag to be assigned if it supports exiting to at least one /8 for 2 out of 3 ports of [80, 443, 6667]. exit_policy_is_general_exit_helper calls tor_addr_is_internal, this function only looks for the following IPv4 spaces: 10/8, 0/8, 127/8, 169.254/16, 172.16/12, 192.168/16.
A relay could put one of the unallocated IPv4 blocks and fool the Directory Authorities. Of course, if such a relay really wanted to do this, they could also set their relay up to exit to an uninteresting /8 no one would ever visit, such as one of the many military/DoD /8's.
Zack Weinberg's thread on tor-relays seems to have a good collection of addresses[1]. Other sources are the exclude list from massscan[2] and the IANA registry[3].
This would probably doubly true for IPv6, which only looks for fc00/7, fe80/10, fec0/10 - but right now exit_policy_is_general_exit_helper ignores IPv6.
[0] http://www.iana.org/assignments/multicast-addresses/multicast-addresses.xhtml [1] https://lists.torproject.org/pipermail/tor-relays/2014-April/004431.html [2] https://github.com/robertdavidgraham/masscan/blob/master/data/exclude.conf [3] http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xhtml
Activity
changed milestone to %Tor: unspecified
Related to #11264 (moved), which could reduce the likelihood of this issue, at the risk of adding more corner cases (in its current form, anyway.)
The core of this issue appears to be that the Exit flag code is optimistic (just needs a /8 and 2 ports), but the microdescriptor exit policy summary code is pessimistic (needs the entire internet).
We need a proposal to fix the microdescriptor exit policy summary code (and a new consensus method), but the Exit flag could be fixed to be more pessimistic straight away, as it is assigned by authorities.
Perhaps it is easiest to just make one depend on the other? (A quick fix would be to summarise the exit policy, then use that as input to the Exit flag determination. This would also require a documentation fix.)
Trac:
Milestone: Tor: 0.2.6.x-final to Tor: 0.2.7.x-final
