[tor-relays] Domain name based policies (was: Call for discussion: turning funding into more exit relays)

[Nicolas Braud-Santoni]

2012/8/1 Roger Dingledine <arma at mit.edu>:
> On Tue, Jul 31, 2012 at 11:21:01AM +0100, mick wrote:
>> Question for tor developers. How hard would it be to change the logic
>> (and syntax) of exit policy in tor to allow domain based formulations
>> like:
>>
>> reject *.gmail.com
>> reject *aol.com
>
> Very hard.
>
> https://trac.torproject.org/projects/tor/wiki/doc/TorFAQ#ExitpoliciesshouldbeabletoblockwebsitesnotjustIPaddresses

Hi,

While I see how allowing wildcards and domains in policies would be
more than challenging, wouldn't it be possible to :
- resolve domain-names at Tor startup, and get all associated A and AAAA records
- Repeat when record's TTL is reached.

Of course, it wouldn't work for sites that don't advertise all their IPs.

It would also require the Exit node's operator to run some DNS
resolver (or trust an external one), but locally running unbound (for
example) is quite simple.
Moreover, the risk evoked in the FAQ is already present : if I poison
an exit node's DNS resolver, wouldn't I be able to replace nytimes.com
A record with some bogon, like 0.0.0.0 ?

Nicolas