From b43b9156614596e73df63be69ee439be93444802 Mon Sep 17 00:00:00 2001 From: teor Date: Tue, 28 Apr 2020 21:07:24 +1000 Subject: tor-spec: Do the same extend checks as tor Update the extend checks to match tor's implementation, particularly the comments in channel_tls_matches_target_method(). --- tor-spec.txt | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'tor-spec.txt') diff --git a/tor-spec.txt b/tor-spec.txt index 7f0256e..df0ca38 100644 --- a/tor-spec.txt +++ b/tor-spec.txt @@ -1378,8 +1378,10 @@ see tor-design.pdf. - The IP matches the requested IP. - The OR knows that the IP of the connection it's using is canonical because it was listed in the NETINFO cell. - - The OR knows that the IP of the connection it's using is canonical - because it was listed in the server descriptor. + + ORs SHOULD NOT check the IPs that are listed in the server descriptor. + Trusting server IPs makes it easier to covertly impersonate a relay, after + stealing its keys. 5.4. Tearing down circuits -- cgit v1.2.3-54-g00ecf