[tor-bugs] #13043 [Tor]: torspec lies about accepting both IPv4 and IPv6 for ORAddress lines

[Tor Bug Tracker & Wiki]

#13043: torspec lies about accepting both IPv4 and IPv6 for ORAddress lines
---------------------------------------+---------------------
 Reporter:  isis                       |          Owner:
     Type:  defect                     |         Status:  new
 Priority:  normal                     |      Milestone:
Component:  Tor                        |        Version:
 Keywords:  torspec, bridgedb-parsers  |  Actual Points:
Parent ID:                             |         Points:
---------------------------------------+---------------------
 (From [https://trac.torproject.org/projects/tor/ticket/9380#comment:27
 this comment on #9380])

 '''tl;dr''': The `"a"`/`"or-address"` lines, ''in implementation'', only
 happen once each per router, and only ever contain IPv6 addresses, despite
 what `dir-spec.txt` says.


 The spec
 [https://gitweb.torproject.org/torspec.git/blob/d4cb76a81f26dcc41a2c2041b12977dfdf62c3f8
 :/dir-spec.txt#l1166 says]:

 {{{
      "a" SP address ":" port NL

         [Any number]

         The "or-address" element as specified in section 2.1.1.
 }}}

 [https://gitweb.torproject.org/torspec.git/blob/d4cb76a81f26dcc41a2c2041b12977dfdf62c3f8
 :/dir-spec.txt#l587 and]:

 {{{
    "or-address" SP ADDRESS ":" PORT NL

        [Any number]

        ADDRESS = IP6ADDR | IP4ADDR
        IPV6ADDR = an ipv6 address, surrounded by square brackets.
        IPV4ADDR = an ipv4 address, represented as a dotted quad.
        PORT = a number between 1 and 65535 inclusive.
        An alternative for the address and ORPort of the "router" line, but
 with
        two added capabilities:

          * or-address can be either an IPv4 or IPv6 address
          * or-address allows for multiple ORPorts and addresses

        A descriptor SHOULD NOT include an or-address line that does
 nothing but
        duplicate the address:port pair from its "router" line.

        The ordering of or-address lines and their PORT entries matter
 because
        Tor MAY accept a limited number of addresses or ports. As of Tor
 0.2.3.x
        only the first address and the first port are used.
 }}}

  - In terms of how many `"a"`/`"or-address"` lines there may be, the spec
 is only correct if you pay ''super close attention to the last sentence''
 (this is actually the first time I've noticed it :) ).

  - In terms of whether IPv4 and/or IPv6 addresses are acceptable, ''the
 spec is currently wrong'',  according to the functions
 `router_rebuild_descriptor()`
 [https://gitweb.torproject.org/tor.git/blob/9f9b19ed7b06d8313a9bcbd6647fa097ec0a059d:/src/or/router.c#l1811
 [source]] and `router_dump_router_to_string()`
 [https://gitweb.torproject.org/tor.git/blob/9f9b19ed7b06d8313a9bcbd6647fa097ec0a059d:/src/or/router.c#l2330
 [source]] in `src/or/router.c` in tor's source code.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13043>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online