[tor-commits] [torspec/master] Prop 312: Rewrite authenticated address detection
teor at torproject.org
teor at torproject.org
Wed Feb 5 12:07:24 UTC 2020
commit 043ac7d7aa9e0b48ef7f80e8cfb1b6b2f5ce2f39
Author: teor <teor at torproject.org>
Date: Tue Feb 4 19:19:12 2020 +1000
Prop 312: Rewrite authenticated address detection
All these changes are optional in the proposal:
* Add the NETINFO cell address detection method
(as suggested by Nick Mathewson)
* Defer decisions about ignoring some addresses, or using those
addresses as the lowest priority method
* Simplify the load-balancing design
Part of 33073.
---
proposals/312-relay-auto-ipv6-addr.txt | 359 ++++++++++++++++++++++++---------
1 file changed, 263 insertions(+), 96 deletions(-)
diff --git a/proposals/312-relay-auto-ipv6-addr.txt b/proposals/312-relay-auto-ipv6-addr.txt
index c167329..a6d89e4 100644
--- a/proposals/312-relay-auto-ipv6-addr.txt
+++ b/proposals/312-relay-auto-ipv6-addr.txt
@@ -519,6 +519,7 @@ Ticket: #33073
(also minimise consensus size)
* store a list of previous addresses in the state file, and use the most
recently used address that's currently available.
+
Operators who want to avoid address flipping should set the Address option
in the torrc. Operators who want to minimise the size of the consensus
should use all-zero IPv6 host identifiers.
@@ -531,13 +532,46 @@ Ticket: #33073
Some of these changes may be more appropriate in future releases, or
along with other proposed features.
-3.5.1. Only Use Authenticated Directory Header IPv4 and IPv6 Addresses
+ Some of these changes make tor ignore some potential IP addresses.
+
+ Ignoring addresses risks relays having no available ORPort addresses, and
+ refusing to publish their descriptor. So before we ignore any addresses, we
+ should make sure that:
+ * tor's other address detection methods are robust and reliable, and
+ * we would prefer relays to shut down, rather than use the ignored
+ address.
+
+ As a less severe alternative, low-quality methods can be put last in the
+ address resolution order. (See section 3.2.)
+
+ If relays prefer addresses from particular sources (for example: ORPorts),
+ they should try these sources regularly, so that their addresses do not
+ become too old.
+
+ If relays ignore addresses from some sources (for example: DirPorts), they
+ must regularly try other sources (for example: ORPorts).
+
+3.5.1. Using Authenticated IPv4 and IPv6 Addresses
We propose this optional change, to improve relay (and bridge) address
accuracy and reliability.
- Relays should only use authenticated directory fetches to discover their
- own IPv4 and IPv6 addresses.
+ Relays should try to use authenticated connections to discover their own
+ IPv4 and IPv6 addresses.
+
+ Tor supports two kinds of authenticated address information:
+ * authenticated directory connections, and
+ * authenticated NETINFO cells.
+ See the following sections for more details.
+
+ See also sections 3.5.2 (for preferring addresses from directory
+ authorities) and 3.5.3 (for load-balancing).
+
+3.5.1.1. Authenticated Directory Connections
+
+ We propose this optional change, to improve relay address accuracy and
+ reliability. (Bridges are not affected, because they already use
+ authenticated directory connections, just like clients.)
Tor supports authenticated, encrypted directory fetches using BEGINDIR over
ORPorts (see the [Tor Specification] for details).
@@ -548,82 +582,216 @@ Ticket: #33073
authenticated directory fetches.)
Using authenticated directory headers for relay addresses:
- * avoids caches (or other machines) mangling X-Your-Address-Is headers in
- transit, and
- * avoids attacks where directories are deliberately given an incorrect IP
- address.
+ * provides authenticated address information,
+ * reduces the number of attackers that can deliberately give a relay an
+ incorrect IP address, and
+ * avoids caches (or other machines) accidentally mangling, deleting, or
+ repeating X-Your-Address-Is headers.
- To make this change, we need to modify two different parts of tor:
+ To make this change, we need to modify tor's directory connection code:
* when making directory requests, relays should fetch some directory
- documents using BEGINDIR over ORPorts, and
- * when using the X-Your-Address-Is HTTP header to guess their own IPv4 or
- IPv6 addresses, relays ignore directory documents that were not fetched
- using BEGINDIR over ORPorts.
+ documents using BEGINDIR over ORPorts.
- See also sections 3.5.2 (for preferring addresses from directory
- authorities) and 3.5.3 (for load-balancing).
+ Once tor regularly gets authenticated X-Your-Address-Is headers, relays can
+ change how they handle unauthenticated addresses. When they receive an
+ unauthenticated address suggestion, relays can:
+ * ignore the address, or
+ * use the address as the lowest priority address method.
+ See section 3.5 for some factors to consider when making this design
+ decision.
-3.5.2. Preferring IPv4 and IPv6 Addresses from Directory Authorities
+ For anonymity reasons, bridges are unable to fetch directory documents over
+ IPv6, until clients start to do so. (See
+ [Proposal 306: Client Auto IPv6 Connections].)
+
+ Bridges currently use authenticated IPv4 connections for all their
+ directory fetches, to imitate default client behaviour.
+
+ We describe a related change, which is also optional:
+
+ We can increase the number of ORPort directory fetches:
+ * if tor has an existing ORPort connection to a relay that it has selected
+ for a directory fetch, it should use an ORPort fetch, rather than
+ opening an additional DirPort connection.
+
+ Using an existing ORPort connection:
+ * saves one DirPort connection and file descriptor,
+ * but slightly increases the cryptographic processing done by the relay,
+ and by the directory server it is connecting to.
+ However, the most expensive cryptographic operations have already happened,
+ when the ORPort connection was opened.
+
+ This change does not increase the number of NETINFO cells, because it
+ re-uses existing OR connections. See the next section for more details.
+
+3.5.1.2. Authenticated NETINFO Cells
We propose this optional change, to improve relay (and bridge) address
+ accuracy and reliability. (Bridge IPv6 addresses are not affected, because
+ bridges only make OR connections over IPv4, to imitate default client
+ behaviour.)
+
+ Tor supports authenticated IPv4 and IPv6 address information, using the
+ NETINFO cells exchanged at the beginning of each ORPort connection (see the
+ [Tor Specification] for details).
+
+ Relays do not currently use any address information from NETINFO cells.
+
+ Using authenticated NETINFO cells for relay addresses:
+ * provides authenticated address information,
+ * reduces the number of attackers that can deliberately give a relay an
+ incorrect IP address, and
+ * does not require a directory fetch (NETINFO cells are sent during
+ connection setup).
+
+ To make this change, we need to modify tor's cell processing:
+ * when processing NETINFO cells, tor should store the OTHERADDR field,
+ like it currently does for X-Your-Address-Is HTTP headers, and
+ * IPv4 and IPv6 addresses should be stored separately.
+ See the previous section, and section 3.2.5 for more details about the
+ X-Your-Address-Is HTTP header.
+
+ Once tor uses NETINFO cell addresses, relays can change how they handle
+ unauthenticated X-Your-Address-Is headers. When they receive an
+ unauthenticated address suggestion, relays can:
+ * ignore the address, or
+ * use the address as the lowest priority address method.
+ See section 3.5 for some factors to consider when making this design
+ decision.
+
+ We propose that tor continues to use the X-Your-Address-Is header, and adds
+ support for addresses in NETINFO cells. X-Your-Address-Is headers are sent
+ once per directory document fetch, but NETINFO cells are only sent once per
+ OR connection.
+
+ If a relay:
+ * only gets addresses from NETINFO cells from authorities, and
+ * has an existing, long-term connection to every authority,
+ then it may struggle to detect address changes.
+
+ Once all supported tor versions use NETINFO cells for address detection, we
+ should review this design decision. If we are confident that almost all
+ relays will be forced to make new connections when their address changes,
+ then tor may be able to stop using X-Your-Address-Is HTTP headers.
+
+ Bridges only make OR connections, and those OR connections are only over
+ IPv4, to imitate default client behaviour.
+
+ For anonymity reasons, bridges are unable to make regular connections over
+ IPv4 and IPv6, until clients start to do so. (See
+ [Proposal 306: Client Auto IPv6 Connections].)
+
+ As an alternative design, if tor's addresses are stale, it could close some
+ of its open directory authority connections. (Similar to section 4.4.2
+ in [Proposal 311: Relay IPv6 Reachability], where relays close existing OR
+ connections, before testing their own reachability.) However, this design is
+ more complicated, because it involves tracking address age, as well as the
+ address itself.
+
+3.5.2. Preferring IPv4 and IPv6 Addresses from Directory Authorities
+
+ We propose this optional change, to improve relay (but not bridge) address
accuracy and reliability.
- Relays store the latest IPv4 and IPv6 addresses received from:
- * a directory authority, and
- * a directory mirror,
- and prefer the address from a directory authority, as long as it is not
- too old.
-
- Relays should also store a timestamp for each address, and ignore addresses
- where:
- * the timestamp is too old, or
- * the timestamp for the preferred address (from a directory authority)
- is much older than the timestamp for the other address (from a directory
- mirror).
-
- Relays should try directory authorities often enough, that their addresses
- usually do not become too old. (And if the addresses do become too old,
- relays should try directory authorities more often.)
-
- As an alternative, relays could ignore addresses from other relays:
- * when using the X-Your-Address-Is HTTP header to guess their own IPv4 or
- IPv6 addresses, relays ignore directory documents that were not fetched
- from directory authorities.
- However, this implementation is not ideal, because it is better for a relay
- to use an address from a directory mirror, than have no address at all.
+ Relays prefer IPv4 and IPv6 address suggestions received from Directory
+ Authorities.
+
+ When they receive an address suggestion from a directory mirror, relays can:
+ * ignore the address, or
+ * use the address as the lowest priority address method.
+ See section 3.5 for some factors to consider when making this design
+ decision.
+
+ Bridges only make OR connections, and those OR connections are only over
+ IPv4, to imitate default client behaviour.
+
+ For anonymity reasons, bridges are unable to make regular connections over
+ IPv6, until clients start to do so. (See
+ [Proposal 306: Client Auto IPv6 Connections].)
See also sections 3.5.1 (for only using addresses from authenticated
connections) and 3.5.3 (for load-balancing).
3.5.3. Load Balancing
- We propose some optional changes to improve load-balancing.
+ We propose some optional changes to improve relay (and bridge)
+ load-balancing across directory authorities.
3.5.3.1. Directory Authority Load Balancing
- Ideally, we would like all relays (and bridges) to do frequent directory
- fetches:
+ Relays may prefer:
+ * authenticated connections (section 3.5.1).
+
+ Relays and bridges may prefer:
+ * connecting to Directory Authorities (section 3.5.2).
+
+ Both these changes are optional, so they might not be implemented.
+
+ If both changes are implemented, we would like all relays (and bridges) to
+ do frequent directory fetches:
* using BEGINDIR over ORPorts,
* to directory authorities.
- However, this change may be unsustainable during high network load
- (see [Ticket 33018: Dir auths using an unsustainable 400+ mbit/s]).
+ However, this extra load from relays may be unsustainable during high
+ network load (see
+ [Ticket 33018: Dir auths using an unsustainable 400+ mbit/s]).
+
+ For anonymity reasons, bridges should avoid connecting to directory
+ authorities too frequently, to imitate default client behaviour.
Therefore, we propose a simple load-balancing scheme between address
resolution and non-address resolution requests:
- * when relays do not know their own IP addresses, they should make as many
- directory authority ORPort directory fetches as is sustainable, and
- * when relays know their own IP addresses, they should make an occasional
- directory authority ORPort directory fetch, to learn if their address
- has changed.
+ * when relays first start up, they should make two directory authority
+ ORPort fetch attempts, one on IPv4, and one on IPv6,
+ * relays should also make occasional directory authority ORPort directory
+ fetch attempts, on IPv4 and IPv6, to learn if their addresses have
+ changed.
- We use the load-balancing criteria in section 3.5.3.3, to select the ratio
- between:
- * ORPort connections to directory authorities, and
- * ORPort or DirPort connections to directory mirrors.
+ We propose a new torrc option and consensus parameter:
- It should be possible for relays to choose between ORPort and DirPort
- connections to directory mirrors at random: they typically have enough spare
- CPU and bandwidth.
+ RelayMaxIntervalWithoutAddressDetectionRequest N seconds|minutes|hours
+
+ Relays make most of their directory requests via directory mirror DirPorts,
+ to reduce the load on directory authorities.
+
+ When this amount of time has passed since a relay last connected to a
+ directory authority ORPort, the relay makes its next directory request via
+ a directory authority ORPort. (Default: 15 minutes)
+
+ The final name and description for this option will depend on which optional
+ changes are actually implemented in tor. In particular, this option should
+ only consider requests that tor may use to discover its IP addresses.
+ For example:
+ * if tor uses NETINFO cells for addresses (section 3.5.1.2), then all
+ OR connections to an authority should be considered,
+ * if tor does not use NETINFO cells for addresses, and only uses
+ X-Your-Address-Is headers, then only directory fetches from authorities
+ should be considered.
+
+ We set the default value of this option to 15 minutes, because:
+ * tor's reachability tests fail if the ORPort is unreachable after 20
+ minutes. So we want to do at least two address detection requests in
+ the first 20 minutes;
+ * the minimum consensus period is 30 minutes, and we want to do at least
+ one address detection per consensus period. (Consensuses are usually
+ created every hour. But if there is no fresh consensus, directory
+ authorities will try to create a consensus every 30 minutes); and
+ * the default value for TestingAuthDirTimeToLearnReachability is 30
+ minutes. So directory authorities will make reachability test OR
+ connections to each relay, at least every 30 minutes. Therefore, relays
+ will see NETINFO cells from directory authorities about this often.
+ (Relays may use NETINFO cells for address detection, see section
+ 3.5.1.2.)
+
+ See also section 3.5.3.3, for some general load balancing criteria, that
+ may help when tuning the address detection interval.
+
+ We propose a related change, which is also optional:
+
+ If relays use address suggestions from directory mirrors, they may choose
+ between ORPort and DirPort connections to directory mirrors at random.
+ Directory mirrors typically have enough spare CPU and bandwidth to handle
+ ORPort directory requests. (And the most expensive cryptography happens
+ when the ORPort connection is opened.)
See also sections 3.5.1 (for only using addresses from authenticated
connections) and 3.5.2 (for preferring addresses from directory
@@ -633,36 +801,34 @@ Ticket: #33073
We propose this optional change, to improve the load-balancing between IPv4
and IPv6 directories, when used by relays to find their IPv4 and IPv6
- addresses (see section 3.2.6).
+ addresses (see section 3.2.5).
+
+ For anonymity reasons, bridges are unable to make regular connections over
+ IPv6, until clients start to do so. (See
+ [Proposal 306: Client Auto IPv6 Connections].)
This change may only be necessary if the following changes result in poor
load-balancing, or other relay issues:
- * randomly selecting IPv4 or IPv6 directories (see section 3.2.6), or
- * preferring directory header addresses, from directory authorities,
- via an authenticated connection (see sections 3.5.1 and 3.5.2).
+ * randomly selecting IPv4 or IPv6 directories (see section 3.2.5), or
+ * preferring addresses from directory authorities, via an authenticated
+ connection (see sections 3.5.1 and 3.5.2).
- We propose a new torrc option and consensus parameter:
- MaxNumIPv4DirectoryAttempts. This option limits the number of IPv4 directory
- requests, before the relay makes an IPv6 directory request. It should only
- apply to attempts that are expected to provide a usable IPv4 or IPv6
- address in their directory header. (Based on sections 3.2.6, 3.5.1, and
- 3.5.2.)
-
- The design is similar to MaxNumIPv4BootstrapAttempts in
- [Proposal 306: Client Auto IPv6 Connections].
-
- Here is a quick sketch of the design:
- * when MaxNumIPv4DirectoryAttempts is reached, select an IPv6-capable
- directory, and make an IPv6 connection attempt,
- * use a directory authority, or an ORPort, if required (see sections
- 3.5.1 and 3.5.2),
- * use a default value between 2 and 4:
- * the ideal value for load-balancing is >= 2
- (because 6/9 directory authorities are already on IPv6)
- * the ideal value for minimising failures is ~4
- (because relays won't waste too much CPU or bandwidth)
- * choose the default value based on the load-balancing criteria in section
- 3.5.3.3.
+ We propose that the RelayMaxIntervalWithoutAddressDetection option is
+ counted separately for IPv4 and IPv6 (see the previous section for details).
+
+ For example:
+ * if 30 minutes has elapsed since the last IPv4 address detection request,
+ then the next directory request should be an IPv4 address detection
+ request, and
+ * if 30 minutes has elapsed since the last IPv6 address detection request,
+ then the next directory request should be an IPv6 address detection
+ request.
+
+ If both intervals have elapsed at the same time, the relay should choose
+ between IPv4 and IPv6 at random.
+
+ See also section 3.5.3.3, for some general load balancing criteria, that
+ may help when tuning the address detection interval.
Alternately, we could wait until
[Proposal 306: Client Auto IPv6 Connections] is implemented, and use the
@@ -670,20 +836,15 @@ Ticket: #33073
3.5.3.3. General Load Balancing Criteria
- We propose the following criteria for choosing load-balancing ratios:
+ We propose the following criteria for choosing load-balancing intervals:
- The selected ratios should be chosen based on the following factors:
- * the current number of directory fetches that a relay makes:
- * when bootstrapping with an empty cache directory, and
- * in a steady state (per hour, or per new consensus),
- (these numbers aren't currently collected by tor, so we may need to
- write some extra code to include them in the heartbeat logs),
+ The selected interval should be chosen based on the following factors:
* relays need to discover their IPv4 and IPv6 addresses to publish their
descriptors,
* it only takes one successful directory fetch from one authority for a
relay to discover its IP address (see section 3.5.2),
- * relays will fall back to addresses from directory mirrors, if directory
- authorities are unavailable (see section 3.5.2),
+ * if relays fall back to addresses discovered from directory mirrors,
+ when directory authorities are unavailable (see section 3.5.2),
* BEGINDIR over ORPort requires and TLS connection, and some additional
tor cryptography, so it is more expensive for authorities than a
DirPort fetch (and it can not be cached by a HTTP cache)
@@ -693,14 +854,20 @@ Ticket: #33073
* other potential changes to relay directory fetches (see
[Ticket 33018: Dir auths using an unsustainable 400+ mbit/s])
- The selected ratios should allow almost all relays to update both their IPv4
- and IPv6 addresses:
- * at least twice when they bootstrap (to allow for fetch failures),
- * at least once per directory fetch (or per hour), and
- * from a directory authority (if available).
+ The selected interval should allow almost all relays to update both their
+ IPv4 and IPv6 addresses:
+ * at least twice when they bootstrap and test reachability (to allow for
+ fetch failures),
+ * at least once per consensus interval (that is, every 30 minutes), and
+ * from a directory authority (if required).
+
+ For anonymity reasons, bridges are unable to make regular connections over
+ IPv6, until clients start to do so. (See
+ [Proposal 306: Client Auto IPv6 Connections].)
In this proposal, relays choose between IPv4 and IPv6 directory fetches
- at random (see section 3.2.6 for more detail).
+ at random (see section 3.2.5 for more detail). But if this change causes
+ issues on IPv4-only relays, we may have to try IPv6 less often.
3.5.4. Detailed Address Resolution Logs
More information about the tor-commits
mailing list