Opened 4 years ago

Last modified 2 years ago

#18608 new defect

Limiting ADD_ONION TARGET access.

Reported by: cypherpunks Owned by:
Priority: Medium Milestone: Tor: unspecified
Component: Core Tor/Tor Version:
Severity: Normal Keywords: tor-hs, tor-control, control-filter control-permissions
Cc: adrelanos Actual Points:
Parent ID: Points: 1
Reviewer: Sponsor:

Description

Please add a torrc option that allows the user to specify the target or port range allowed for an application that creates an ephemeral hidden service.

For example, saying that it can only bind to 12.0.0.1/32 and port range [8080-8090].

The tor client should refuse creating the hidden service if the application tries values outside of that range, for example 127.0.0.1:22 or 192.168.1.1:80

Child Tickets

Change History (10)

comment:1 Changed 4 years ago by cypherpunks

Related to https://trac.torproject.org/projects/tor/ticket/18156

Maybe specifying the port range to 0 would disable ADD_ONION and the tor client would refuse the applications request for creating an ephemeral hidden service.

comment:2 Changed 3 years ago by dgoulet

Keywords: tor-hs control added
Milestone: Tor: 0.2.???
Points: smally
Sponsor: SponsorRSponsorR-can

comment:3 Changed 3 years ago by cypherpunks

We don't want these deanonymization scenarios happening, do we?

add_onion new:best port=80,fbi.gov
add_onion new:best port=80,cmu.edu

comment:4 Changed 3 years ago by adrelanos

Cc: adrelanos added

comment:5 Changed 3 years ago by teor

Milestone: Tor: 0.2.???Tor: 0.3.???

Milestone renamed

comment:6 Changed 3 years ago by nickm

Keywords: tor-03-unspecified-201612 added
Milestone: Tor: 0.3.???Tor: unspecified

Finally admitting that 0.3.??? was a euphemism for Tor: unspecified all along.

comment:7 Changed 2 years ago by nickm

Keywords: tor-03-unspecified-201612 removed

Remove an old triaging keyword.

comment:8 Changed 2 years ago by dgoulet

Keywords: tor-control added; control removed

Unify "control" keyword to "tor-control".

comment:9 Changed 2 years ago by dgoulet

Points: smally1
Sponsor: SponsorR-can

comment:10 Changed 2 years ago by nickm

Keywords: control-filter control-permissions added
Note: See TracTickets for help on using tickets.