3 "Project-Id-Version: Nos oignons website\n"
4 "POT-Creation-Date: 2020-07-06 11:59+0200\n"
5 "PO-Revision-Date: 2020-07-06 11:59+0200\n"
6 "Last-Translator: Nos oignons <webmaster@nos-oignons.net>\n"
7 "Language-Team: English <webmaster@nos-oignons.net>\n"
10 "Content-Type: text/plain; charset=UTF-8\n"
11 "Content-Transfer-Encoding: 8bit\n"
15 msgid "[[!meta title=\"Tor, IPv6 et prises de tête\"]]\n"
16 msgstr "[[!meta title=\"Tor's IPv6 exit policy idiosyncrasy \"]]\n"
20 msgid "[[!meta date=\"2020-07-06 12:00:00\"]]\n"
21 msgstr "[[!meta date=\"2020-07-06 12:00:00\"]]\n"
25 "Chez nos-oignons, nous faisons tourner [plusieurs relais de sortie tor à "
26 "haute capacité](https://nos-oignons.net/Services/index.fr.html), et comme "
27 "nous sommes en 2020, la plupart ont de l'IPv6. Tout allait bien, jusqu'à ce "
28 "qu'on se penche sur le cas d'[elenagb](https://metrics.torproject.org/rs."
29 "html#details/F47B13BFCE4EF48CDEF6C4D7C7A99208EBB972B5), notre nœud hébergé "
30 "chez [Aquilenet](https://www.aquilenet.fr/), et nommé d'après la professeure "
31 "et écrivaine italienne [Elena Gianini Belotti]( https://fr.wikipedia.org/"
32 "wiki/Elena_Gianini_Belotti ). En effet, le consensus pensait que son *exit "
33 "policy* était `reject *:*`, alors que nous voulions qu'il soit un relai de "
34 "sortie. La seule différence avec nos autre relais était que comme notre "
35 "hébergeur ne nous attribuait pas l'IPv4, nous nous étions mis d'accord pour "
36 "n'avoir que du trafic sortant du réseau tor en IPv6. Il y avait donc, "
37 "quelque part, sûrement, un soucis de configuration. Le `torrc` ressemblait "
38 "à ça. En partant du principe que tout le reste soit correctement configuré "
39 "(`ORPort`, `address`, …), arrivez-vous à débusquer l'erreur?"
41 "At nos-oignons we're running a couple of high-speed "
42 "[tor exit nodes](https://nos-oignons.net/Services/index.fr.html), and since "
43 "it's 2020, most of them have IPv6 addresses.\n"
44 "A particular node, [elenagb](https://metrics.torproject.org/rs.html#details/F47B13BFCE4EF48CDEF6C4D7C7A99208EBB972B5), "
45 "named after the Italian feminist writer and teacher "
46 "[Elena Gianini Belotti](https://it.wikipedia.org/wiki/Elena_Gianini_Belotti), "
47 "hosted by [Aquilenet](https://www.aquilenet.fr/ )was doing something odd: "
48 "the consensus thought that its exit policy was `reject *:*`, while we wanted "
49 "it to be an exit node.\n"
50 "The only major difference with our other servers is that we have some issues "
51 "with IPv4 attribution, we agreed with our hoster to only have IPv6 traffic "
52 "exiting from the tor network. There was likely a configuration issue somehow, "
54 "The torrc files looked like this, assuming that everything else (`ORPort`, "
55 "`address`, …) was correct, can you spot the mistake?"
62 "ExitPolicy reject *:*\n"
66 "# Reduced exit policy in IPv6\n"
68 "ExitPolicy accept6 *:20-23 # FTP, SSH, telnet\n"
72 "ExitPolicy accept6 *:64738 # Mumble\n"
74 "ExitPolicy reject6 *:*\n"
79 "ExitPolicy reject *:*\n"
83 "# Reduced exit policy in IPv6\n"
85 "ExitPolicy accept6 *:20-23 # FTP, SSH, telnet\n"
89 "ExitPolicy accept6 *:64738 # Mumble\n"
91 "ExitPolicy reject6 *:*\n"
96 "L'astuce comme souligné dans le [ticket 16069](https://trac.torproject.org/"
97 "projects/tor/ticket/16069) est que la configuration `reject *:*` rejette "
98 "l'IPv4 **ainsi** que l'IPv6 pour des raisons historiques. À ce sujet, la "
99 "[documentation](https://torproject.org/docs/tor-manual.html.en) indique :"
101 "The trick, as outlined in the [ticket 16069](https://trac.torproject.org/)"
102 "is that reject *:* will reject both IPv6 and IPv4, for legacy reasons."
103 "On this topic, the [torrc's documentation](https://torproject.org/docs/tor-manual.html.en) "
104 "states the following:"
109 "> Les entrées `accept6` et `reject6` affectent seulement les politiques de\n"
110 "sortie Ipv6. Utiliser des IPv4 avec `accept6` et `reject6` sera ignoré et\n"
111 "générera une alerte. Les entrées `accept`/`reject` permettent de prendre en\n"
112 "compte l'IPv4 ainsi que l'IPv6. Utiliser `*4` comme adresse IPv4 générique, et `*6`\n"
113 "comme IPv6 générique. `accept`/`reject *` sont utilisés comme générique\n"
114 "concernant IPv4 et IPv6.\n"
116 "> accept6 and reject6 only produce IPv6 exit policy entries. Using an IPv4\n"
117 "address with accept6 or reject6 is ignored and generates a warning.\n"
118 "accept/reject allows either IPv4 or IPv6 addresses. Use *4 as an IPv4\n"
119 "wildcard address, and *6 as an IPv6 wildcard address.\n"
120 "accept/reject * expands to matching IPv4 and IPv6 wildcard address rules.\n"
123 msgid "La bonne configuration ressemblerait donc plutôt à ceci:"
125 "So the correct configuration looks like this:"
130 "# No exit in ipv4\n"
132 "ExitPolicy reject *4:*\n"
136 "# Reduced exit policy in IPv6\n"
138 "ExitPolicy accept6 *:20-23 # FTP, SSH, telnet\n"
140 "ExitPolicy accept6 *:43 # WHOIS\n"
144 "ExitPolicy accept6 *:64738 # Mumble\n"
146 "ExitPolicy accept6 *:64738 # Mumble\n"
148 "ExitPolicy reject6 *:*\n"
153 "# No exit in ipv4\n"
155 "ExitPolicy reject *4:*\n"
159 "# Reduced exit policy in IPv6\n"
161 "ExitPolicy accept6 *:20-23 # FTP, SSH, telnet\n"
163 "ExitPolicy accept6 *:43 # WHOIS\n"
167 "ExitPolicy accept6 *:64738 # Mumble\n"
169 "ExitPolicy accept6 *:64738 # Mumble\n"
171 "ExitPolicy reject6 *:*\n"
179 "Une bonne partie de la soirée fût passée à s'user les yeux sur le problème, "
180 "et évidement, aussitôt le mystère résolu, notre hébergeur nous a informé que "
181 "l'IPv4 nous était maintenant correctement attribuée, et qu'elenagb pouvait "
182 "donc avoir du trafic sortant de tor à la fois en IPv4 et en IPv6."
184 "An embarrassingly large portion of the evening was wasted, and of course, "
185 "as soon as the mystery was solved, our beloved hoster told us that they "
186 "solved the attribution issue, and that we're free to use IPv4 as well for "