{"action":"created","issue":{"url":"https://api.github.com/repos/zugz/tox-DHTAnnouncements/issues/1","repository_url":"https://api.github.com/repos/zugz/tox-DHTAnnouncements","labels_url":"https://api.github.com/repos/zugz/tox-DHTAnnouncements/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/zugz/tox-DHTAnnouncements/issues/1/comments","events_url":"https://api.github.com/repos/zugz/tox-DHTAnnouncements/issues/1/events","html_url":"https://github.com/zugz/tox-DHTAnnouncements/issues/1","id":377308410,"node_id":"MDU6SXNzdWUzNzczMDg0MTA=","number":1,"title":"Wrong ports restriction?","user":{"login":"kurnevsky","id":2943605,"node_id":"MDQ6VXNlcjI5NDM2MDU=","avatar_url":"https://avatars1.githubusercontent.com/u/2943605?v=4","gravatar_id":"","url":"https://api.github.com/users/kurnevsky","html_url":"https://github.com/kurnevsky","followers_url":"https://api.github.com/users/kurnevsky/followers","following_url":"https://api.github.com/users/kurnevsky/following{/other_user}","gists_url":"https://api.github.com/users/kurnevsky/gists{/gist_id}","starred_url":"https://api.github.com/users/kurnevsky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kurnevsky/subscriptions","organizations_url":"https://api.github.com/users/kurnevsky/orgs","repos_url":"https://api.github.com/users/kurnevsky/repos","events_url":"https://api.github.com/users/kurnevsky/events{/privacy}","received_events_url":"https://api.github.com/users/kurnevsky/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-11-05T09:11:10Z","updated_at":"2018-11-05T19:52:10Z","closed_at":null,"author_association":"NONE","body":"> On receiving a Route Request packet, we check that the addressee port is in the range 33445-33454, and if we send a Route Deliver packet to the addressee IP/Port with sendback set to a random 24-byte nonce followed by the addressee IP/Port, authenticated and encrypted using the nonce and the same symmetric key used to generate Ping IDs above.\r\n\r\n> The restriction on ports is to prevent any abuse which could be enabled by having attackers able to cause DHT nodes to send largely attacker-determined packets to arbitrary ports where they might be interpreted under other protocols.\r\n\r\nIt seems it's wrong to allow relaying only to this port range. The protocol doesn't oblige to use this range and it can be changed via `tox_options_set_start_port` and `tox_options_set_end_port` functions or via `tox-bootstrapd.conf`. Also with cone NAT this port is likely to be different, but it allows incoming connections.\r\n\r\nAs a possible alternative - can we allow relaying only to those nodes that we have in our kbuckets, the same way we relay `DHT Request` packets? In this case we won't be able to relay all announcement-related requests via random nodes. The `Relaying` section says only that it helps to reach nodes that can't be reached directly. Is there a security reason why we can't announce using direct connection and relays only for unreachable nodes?"},"comment":{"url":"https://api.github.com/repos/zugz/tox-DHTAnnouncements/issues/comments/436012201","html_url":"https://github.com/zugz/tox-DHTAnnouncements/issues/1#issuecomment-436012201","issue_url":"https://api.github.com/repos/zugz/tox-DHTAnnouncements/issues/1","id":436012201,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNjAxMjIwMQ==","user":{"login":"zugz","id":590069,"node_id":"MDQ6VXNlcjU5MDA2OQ==","avatar_url":"https://avatars0.githubusercontent.com/u/590069?v=4","gravatar_id":"","url":"https://api.github.com/users/zugz","html_url":"https://github.com/zugz","followers_url":"https://api.github.com/users/zugz/followers","following_url":"https://api.github.com/users/zugz/following{/other_user}","gists_url":"https://api.github.com/users/zugz/gists{/gist_id}","starred_url":"https://api.github.com/users/zugz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zugz/subscriptions","organizations_url":"https://api.github.com/users/zugz/orgs","repos_url":"https://api.github.com/users/zugz/repos","events_url":"https://api.github.com/users/zugz/events{/privacy}","received_events_url":"https://api.github.com/users/zugz/received_events","type":"User","site_admin":false},"created_at":"2018-11-05T19:52:10Z","updated_at":"2018-11-05T19:52:10Z","author_association":"OWNER","body":"* Monday, 2018-11-05 at 11:27 -0800 - Evgeny Kurnevsky <notifications@github.com>:\n\n>Reachable nodes with port 33445-33454: 265 (unique addresses)\n>Reachable nodes with other port: 117 (unique addresses)\n\nHmm, that is worse than I expected. What other ports are in use? We \ncould possibly make exceptions for a few ports like 80 and 443...\n\n>> Consider the case of TCP clients who can't use UDP at all. They have \n>> to relay their announcements via TCP servers. They can't expect the \n>> nodes they want to announce at to be in the close lists of the TCP \n>> servers.\n>\n>But it seems TCP is not very useful for amplification attacks, is it? \n>I suppose overhead for TCP connection will be bigger then amplification \n>coefficient (or at least comparable).\n\nI'm not worried about amplification attacks here - the amplification \ncoefficient of the relay packet is about than 1. I'm worried about \ntickling other protocols. Don't you think that's a reasonable worry?\n"}}
{"actor":{"display_login":"zugz"}}