<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><blockquote type="cite"><span>Date: Sat, 18 Apr 2015 08:51:35 +0200</span><br><span>From: Peter Palfrader <<a href="mailto:weasel@torproject.org">weasel@torproject.org</a>></span><br><span></span><br><blockquote type="cite"><span>On Fri, 17 Apr 2015, Jacob Appelbaum wrote:</span><br><span></span><br></blockquote><blockquote type="cite"><blockquote type="cite"><span>On 4/17/15, Ian Goldberg <<a href="mailto:iang@cs.uwaterloo.ca">iang@cs.uwaterloo.ca</a>> wrote:</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>Remember that the purpose is to help first-time clients, who have never</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>used the Tor network before, fetch their very first consensus. To do</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>that, they'll need addresses to contact bundled into the binary and/or</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>distro without being able to look at a consensus first.</span></blockquote></blockquote></blockquote><div><br></div><div>Disabling fallback directories in custom Tor networks (Trac #15642)</div><div><br></div>tor currently doesn't disable the list of fallback directories when the DirAuthorities or Alternate{Bridge,Dir}Authorities options are set.<div><br></div><div>This means that any fallback directories will still be used in test, private and custom Tor networks. This could mix descriptors from the public network in with private Tor network in certain circumstances (at the very least, when the private authorities are unreachable).<br><div><br></div><div>I suspect this is an undiscovered bug in the fallback directories feature. It hasn't really been an issue until now, as the list of fallback directories has been blank.</div><div><br></div><div>I am also concerned that this general area of the code lacks unit tests, which it might be wise to include before we effectively activate it for the first time.</div><div><br></div><div>I've created a git branch with a fix in the trac issue #15642 [0].</div><div>I've also included unit tests for the function I've modified as a commit in that branch.</div><div><br></div><div>But there's currently no coverage for the function that adds fallback directories. (In fact, I mock it in my unit tests, because I need it to do *something* so I know if it has been called or not.)</div><div><br></div><div>Loading from an Authority-Signed file of Fallback Directories</div><div><br></div><div>The function which loads fallback directories currently loads from a string array inside the function, so it would need to be modified to load from a signed file. I support the security benefits of signed fallback directories enough to write client code and unit tests for it, but I'm not sure how the code for the authorities would work - is the proposal to sign a section of the consensus, and output it as a separate file?</div><div><br></div><div>If so, we would either need to backport, and/or wait until a majority of the authorities update to tor versions with the feature. And perhaps a majority of clients as well, controlled by a consensus parameter? (Otherwise, using any entry in the file itself would allow clients to effectively be partitioned from the rest of the network by their behaviour.)</div><div><br></div><div>While I'm making a list, do we need to modify the existing proposal which describes fallback directories?</div><div><br></div><div>Is this change proposed for 0.2.7?</div><div>Or all currently supported releases?</div><div><br></div><div><div>0: <a href="https://trac.torproject.org/projects/tor/ticket/15642#comment:8">https://trac.torproject.org/projects/tor/ticket/15642#comment:8</a></div><div><br></div><div><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><span style="background-color: rgba(255, 255, 255, 0);">teor</span></div><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><span style="background-color: rgba(255, 255, 255, 0);"><br></span></div><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><span style="background-color: rgba(255, 255, 255, 0);">teor2345 at gmail dot com<br>pgp 0xABFED1AC<br><a href="https://gist.github.com/teor2345/d033b8ce0a99adbc89c5">https://gist.github.com/teor2345/d033b8ce0a99adbc89c5</a><br><br>teor at blah dot im<br>OTR C3C57B23 349825DE 929A1DEF C3531C25 A32287ED</span></div></div></div></div></body></html>