diff options
author | Nick Mathewson <nickm@torproject.org> | 2015-04-03 09:52:01 -0400 |
---|---|---|
committer | Nick Mathewson <nickm@torproject.org> | 2015-04-03 09:52:01 -0400 |
commit | 44b48a9b67f2b4900bed872158dd480f38c27c08 (patch) | |
tree | 0bbd8aeae1892be678810b2123a045774fb315be | |
parent | d461e7036fe5cddf390be249436c66286ce992c3 (diff) | |
parent | 01e4bc80cd75bbf2a4ce3b18ff17550eed993bb0 (diff) | |
download | tor-44b48a9b67f2b4900bed872158dd480f38c27c08.tar.gz tor-44b48a9b67f2b4900bed872158dd480f38c27c08.zip |
Merge remote-tracking branch 'origin/maint-0.2.4' into release-0.2.4
-rw-r--r-- | changes/bug15515 | 4 | ||||
-rw-r--r-- | src/or/or.h | 3 | ||||
-rw-r--r-- | src/or/rendmid.c | 14 |
3 files changed, 21 insertions, 0 deletions
diff --git a/changes/bug15515 b/changes/bug15515 new file mode 100644 index 0000000000..dda7c2fcd8 --- /dev/null +++ b/changes/bug15515 @@ -0,0 +1,4 @@ + o Minor features (DoS-resistance): + - Make it harder for attackers to overwhelm hidden services with + introductions, by blocking multiple introduction requests on the + same circuit. Resolves ticket #15515. diff --git a/src/or/or.h b/src/or/or.h index 34f055cf06..4459957a06 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3157,6 +3157,9 @@ typedef struct or_circuit_t { * to the specification? */ unsigned int remaining_relay_early_cells : 4; + /* We have already received an INTRODUCE1 cell on this circuit. */ + unsigned int already_received_introduce1 : 1; + /** True iff this circuit was made with a CREATE_FAST cell. */ unsigned int is_first_hop : 1; diff --git a/src/or/rendmid.c b/src/or/rendmid.c index 1bd11f6dc0..0a005a6312 100644 --- a/src/or/rendmid.c +++ b/src/or/rendmid.c @@ -149,6 +149,20 @@ rend_mid_introduce(or_circuit_t *circ, const uint8_t *request, goto err; } + /* We have already done an introduction on this circuit but we just + received a request for another one. We block it since this might + be an attempt to DoS a hidden service (#15515). */ + if (circ->already_received_introduce1) { + log_fn(LOG_PROTOCOL_WARN, LD_REND, + "Blocking multiple introductions on the same circuit. " + "Someone might be trying to attack a hidden service through " + "this relay."); + circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_TORPROTOCOL); + return -1; + } + + circ->already_received_introduce1 = 1; + /* We could change this to MAX_HEX_NICKNAME_LEN now that 0.0.9.x is * obsolete; however, there isn't much reason to do so, and we're going * to revise this protocol anyway. |