aboutsummaryrefslogtreecommitdiff
path: root/doc/spec/tor-fw-helper-spec.txt
diff options
context:
space:
mode:
Diffstat (limited to 'doc/spec/tor-fw-helper-spec.txt')
-rw-r--r--doc/spec/tor-fw-helper-spec.txt57
1 files changed, 0 insertions, 57 deletions
diff --git a/doc/spec/tor-fw-helper-spec.txt b/doc/spec/tor-fw-helper-spec.txt
deleted file mode 100644
index 0068b2655..000000000
--- a/doc/spec/tor-fw-helper-spec.txt
+++ /dev/null
@@ -1,57 +0,0 @@
-
- Tor's (little) Firewall Helper specification
- Jacob Appelbaum
-
-0. Preface
-
- This document describes issues faced by Tor users who are behind NAT devices
- and wish to share their resources with the rest of the Tor network. It also
- explains a possible solution for some NAT devices.
-
-1. Overview
-
- Tor users often wish to relay traffic for the Tor network and their upstream
- firewall thwarts their attempted generosity. Automatic port forwarding
- configuration for many consumer NAT devices is often available with two common
- protocols NAT-PMP[0] and UPnP[1].
-
-2. Implementation
-
- tor-fw-helper is a program that implements basic port forwarding requests; it
- may be used alone or called from Tor itself.
-
-2.1 Output format
-
- When tor-fw-helper has completed the requested action successfully, it will
- report the following message to standard output:
-
- tor-fw-helper: SUCCESS
-
- If tor-fw-helper was unable to complete the requested action successfully, it
- will report the following message to standard error:
-
- tor-fw-helper: FAILURE
-
- All informational messages are printed to standard output; all error messages
- are printed to standard error. Messages other than SUCCESS and FAILURE
- may be printed by any compliant tor-fw-helper.
-
-2.2 Output format stability
-
- The above SUCCESS and FAILURE messages are the only stable output formats
- provided by this specification. tor-fw-helper-spec compliant implementations
- must return SUCCESS or FAILURE as defined above.
-
-3. Security Concerns
-
- It is probably best to hand configure port forwarding and in the process, we
- suggest disabling NAT-PMP and/or UPnP. This is of course absolutely confusing
- to users and so we support automatic, non-authenticated NAT port mapping
- protocols with compliant tor-fw-helper applications.
-
- NAT should not be considered a security boundary. NAT-PMP and UPnP are hacks
- to deal with the shortcomings of user education about TCP/IP, IPv4 shortages,
- and of course, NAT devices that suffer from horrible user interface design.
-
-[0] http://en.wikipedia.org/wiki/NAT_Port_Mapping_Protocol
-[1] http://en.wikipedia.org/wiki/Universal_Plug_and_Play