<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 11 Oct 2015, at 13:47, <a href="mailto:starlight.2015q3@binnacle.cx" class="">starlight.2015q3@binnacle.cx</a> wrote:</div><br class="Apple-interchange-newline"><div class="">At 13:29 10/8/2015 -0400, <a href="mailto:starlight.2015q3@binnacle.cx" class="">starlight.2015q3@binnacle.cx</a> wrote:<br class=""><blockquote type="cite" class="">Occasionally I run into a relay such as<br class=""><br class="">Bywadu 5A0DE94C95E2276B4BAC974A7D8FC6463C4FE8A4<br class="">OR ip 178.33.157.6<br class="">exit ip 31.7.58.37<br class=""><br class="">Where the egress/exit IP source address is<br class="">not found in the Exit DB, shows up negative<br class="">on ExoneraTor. TorCheck complains. . .<br class=""></blockquote><br class="">Is it perhaps because the exit policy<br class="">for the above and similar relays does<br class="">not contain a "reject" line for the<br class="">alternate IP, as in<br class=""><br class="">reject 178.33.157.6:* # present<br class="">reject 31.7.58.37:* # missing<br class=""><br class="">The OR-address "reject" is automatic<br class="">and I'm guessing that if one uses<br class="">OutboundBindAddress in the config that<br class="">would also be included.<br class=""></div></blockquote><div><br class=""></div><div>Unfortunately not (see below).</div><br class=""><blockquote type="cite" class=""><div class="">But if 'torrc' does not contain the<br class="">alternate interface IP(s) does the<br class="">'tor' daemon recognize alternate<br class="">egress source interfaces or does<br class="">one have to configure the "reject"<br class="">lines manually?<br class=""></div></blockquote><div><br class=""></div><div>As of 0.2.7.3, tor blocks the following addresses by default (ExitPolicyRejectPrivate):</div><div>* the configured or autodiscovered IPv4 address (Address or resolve_my_address())</div><div>* the configured IPv6 address (first IPv6 ORPort entry)</div><div>* the publicly routable IPv4 or IPv6 address(es) of every interface on the server, if available.</div><div>(Local and private addresses are already blocked by ExitPolicyRejectPrivate.)</div><div><br class=""></div><div>It’s my opinion that this covers the majority of use cases for multihomed, multi-IP, or different internal/external address (that is, NAT or similar) relays.</div><div><br class=""></div><div>This change was tracked and merged as #17027: policies_parse_exit_policy_internal should block all IPv4 and IPv6 local</div>addresses.</div><div><a href="https://trac.torproject.org/projects/tor/ticket/17027" class="">https://trac.torproject.org/projects/tor/ticket/17027</a></div><div>This change is being considered for backport to 0.2.6 as a security fix.</div><div><br class=""></div><div><div>The behaviour as of 0.2.7.2-alpha and below was to only block the configured or autodiscovered IPv4 address.</div><div><br class=""></div><div>However, a look through the Tor manual page suggests the following additional candidate addresses:</div><div>* OutboundBindAddress</div><div>* ControlPort / ControlListenAddress</div><div>* SOCKSPort / SOCKSListenAddress</div><div>* TransPort / TransListenAddress</div><div>* NATDPort / NATDListenAddress</div><div>* DNSPort / DNSListenAddress</div><div>* ORPort / ORListenAddress (IPv4 entries or subsequent IPv6 entries)</div><div>* DirPort / DirListenAddress</div><div><br class=""></div><div>We could block these by looking at OutboundBindAddressIPv4_/OutboundBindAddressIPv6_ and get_configured_ports().</div><div>(I’ve added a note about these changes to issue #17027.)</div><div><br class=""></div><div>I’d also consider the IPv6 address (if available) from Address (if an IPv6 literal [this doesn’t work at present] or DNS name), but Address isn’t used by Tor to find IPv6 addresses, so I’m not sure how useful this is.</div><div><br class=""></div><blockquote type="cite" class=""><div class="">Have not come across any documentation<br class="">on this.</div></blockquote><div><br class=""></div><div>Please see the Tor 0.2.7.3 manual page under “ExitPolicyRejectPrivate” (the version on the Tor website is too old) or Trac bug #17027.</div><div><a href="https://trac.torproject.org/projects/tor/ticket/17027" class="">https://trac.torproject.org/projects/tor/ticket/17027</a></div><br class=""><blockquote type="cite" class=""><div class="">Would it be considered a<br class="">bug in the Tor daemon that it does<br class="">not gather multi-home source IPs<br class="">for "reject" in the exit policy?<br class=""></div></blockquote><div><br class=""></div><div>Yes (see above).</div><br class=""><blockquote type="cite" class=""><div class="">If a relay is missing an egress IP<br class="">"reject" line and has no contact,<br class="">would that be a serious misconfiguration<br class="">that indicates BadExit should be<br class="">assigned?<br class=""></div></blockquote><br class=""></div><div>There may be valid reasons why an operation explicitly wants to allow Tor users to exit to their own server.</div><div>In this case, they would have to make sure that local services don’t assume that local connections are trusted.</div><div><br class=""></div><div>Tim</div><br class=""><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Tim Wilson-Brown (teor)</div><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""></div><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">teor2345 at gmail dot com<br class="">PGP 968F094B<br class=""><br class="">teor at blah dot im<br class="">OTR CAD08081 9755866D 89E2A06F E3558B7F B5A9D14F</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div>
<br class=""></body></html>