Opened 4 months ago

Last modified 5 days ago

#33237 new defect

Prop 312: 3.2.2. Stop Directory Authorities Resolving *Port Hostnames

Reported by: teor Owned by:
Priority: Medium Milestone: Tor: 0.4.4.x-final
Component: Core Tor/Tor Version:
Severity: Normal Keywords: prop312, tor-dirauth, security-low, 044-must
Cc: Actual Points:
Parent ID: #33049 Points: 1
Reviewer: Sponsor: Sponsor55-must

Description (last modified by teor)

For security reasons, directory authorities only use addresses that are
explicitly configured in their torrc. Therefore, we propose that directory
authorities only accept IPv4 or IPv6 address literals in the address part
of the ORPort and DirPort options.

As part of this fix, we may also ban DNS resolution on all configured Ports. (We should try to avoid banning DNS resolution entirely on authorities, because some test networks use Authority/Exits.)

See proposal 312, section 3.2.2, directory authority case:

Directory authorities must not attempt to resolve these
addresses using DNS. It is a config error to provide a hostname as a
directory authority's ORPort or DirPort.

If directory authorities don't have an IPv4 address literal in their
Address or ORPort, they should issue a configuration error, and refuse to
launch. If directory authorities don't have an IPv6 address literal in their
Address or ORPort, they should issue a notice-level log, and fall back to
only using IPv4.

Child Tickets

Change History (5)

comment:1 Changed 4 months ago by teor

Description: modified (diff)

comment:2 Changed 4 months ago by teor

Owner: teor deleted

Un-assign myself from Sponsor55-can tickets.

comment:3 Changed 3 months ago by teor

Status: assignednew

Change tickets that are assigned to nobody to "new".

comment:4 Changed 4 weeks ago by teor

Sponsor: Sponsor55-canSponsor55-must

I think we should do #33237 and #33239, but they aren't urgent, so we should leave them until the end of the project.

comment:5 Changed 5 days ago by nickm

Keywords: 044-must added

Add 044-must to all security tickets in 0.4.4

Note: See TracTickets for help on using tickets.