[tor-bugs] #17605 [Tor]: Tell caches to remove X-Your-IP-Address-Is from Tor Directory documents

[Tor Bug Tracker & Wiki]

#17605: Tell caches to remove X-Your-IP-Address-Is from Tor Directory documents
----------------------+------------------------------------
 Reporter:  teor      |          Owner:
     Type:  defect    |         Status:  new
 Priority:  High      |      Milestone:  Tor: 0.2.8.x-final
Component:  Tor       |        Version:
 Severity:  Normal    |     Resolution:
 Keywords:  tor-auth  |  Actual Points:
Parent ID:            |         Points:
  Sponsor:            |
----------------------+------------------------------------

Comment (by teor):

 Replying to [comment:4 arma]:
 > What if we went a step further and didn't include the header at all in
 unencrypted connections? That is, we include it in the begin_dir response
 but not in the naked dirport responses.

 I think this is an excellent idea. As the HTTP headers of a naked dirport
 response are unauthenticated, they can be modified in transit, and we
 can't know either way.

 > The main effect would be that relays, who use the naked dirport, would
 no longer be able to learn their IP address from their directory authority
 interactions.

 A relay believes any directory mirror, not just the authorities. But if it
 doesn't know its IP address, it will only connect to authorities.

 > We could work around that by finally moving all dir traffic to begin_dir
 (which still makes me uncomfortable because of the extra scaling and load,
 but maybe this is a good additional kick for why we should do it anyway),
 or by having relays who don't know their address launch a begin_dir
 connection just for finding it out.

 With the introduction of fallback directory mirrors in 0.2.8 (#15775), the
 extra load for bootstrap begindirs will be shared among 100-250 high-
 uptime directory mirrors, rather than just the ~9 authorities.

 After bootstrap, with the introduction of "dir servers for all" (#12538)
 in 0.2.8, it will be shared among almost all relays.

 So I think we can do begindirs for all directory fetches. We might want to
 fix #17848 at the same time, otherwise clients and relays won't know if
 they have an existing connection to a  directory server, and load
 balancing will suffer.

 > Actually, wait a minute, don't netinfo cells have your address in them
 now too? Does that mean x-your-address-is on naked dirport answers is
 redundant? And thus we should try to phase it out in favor of the
 encrypted, authenticated mechanism that we built?

 It has the relay's IPv4 address.

 (Although it's somewhat orthogonal, we'd like to have some way for relays
 to learn their IPv6 addresses, too. This would be somewhat easier to do by
 adding a HTTP header, rather than changing the format of a NETINFO cell.
 See #5940.)

 > The reason I want to get rid of the caching situation is because this is
 an information leak, from one user to another. Now, it's mostly just
 relays who suffer, since they're the ones who use naked dirport requests.
 But this is still an uncomfortable state of affairs to leave in place.

 Let's fix it then!

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17605#comment:5>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online