hs-v3: Require reasonably live consensus

Some days before this commit, the network experienced a DDoS on the directory
authorities that prevented them to generate a consensus for more than 5 hours
straight.

That in turn entirely disabled onion service v3, client and service side, due
to the subsystem requiring a live consensus to function properly.

We know require a reasonably live consensus which means that the HSv3
subsystem will to its job for using the best consensus tor can find. If the
entire network is using an old consensus, than this should be alright.

If the service happens to use a live consensus while a client is not, it
should still work because the client will use the current SRV it sees which
might be the previous SRV for the service for which it still publish
descriptors for.

If the service is using an old one and somehow can't get a new one while
clients are on a new one, then reachability issues might arise. However, this
is a situation we already have at the moment since the service will simply not
work if it doesn't have a live consensus while a client has one.

Fixes #40237

Signed-off-by: David Goulet <dgoulet@torproject.org>

4 files changed, 23 insertions, 9 deletions

diff --git a/src/feature/hs/hs_cache.c b/src/feature/hs/hs_cache.c
index 05f9940ae6..042ec55fa4 100644
--- a/src/feature/hs/hs_cache.c
+++ b/src/feature/hs/hs_cache.c
@@ -17,6 +17,7 @@
 #include "feature/hs/hs_common.h"
 #include "feature/hs/hs_client.h"
 #include "feature/hs/hs_descriptor.h"
+#include "feature/nodelist/microdesc.h"
 #include "feature/nodelist/networkstatus.h"
 #include "feature/rend/rendcache.h"
 
@@ -673,7 +674,9 @@ cached_client_descriptor_has_expired(time_t now,
   /* We use the current consensus time to see if we should expire this
    * descriptor since we use consensus time for all other parts of the protocol
    * as well (e.g. to build the blinded key and compute time periods). */
-  const networkstatus_t *ns = networkstatus_get_live_consensus(now);
+  const networkstatus_t *ns =
+    networkstatus_get_reasonably_live_consensus(now,
+      usable_consensus_flavor());
   /* If we don't have a recent consensus, consider this entry expired since we
    * will want to fetch a new HS desc when we get a live consensus. */
   if (!ns) {
diff --git a/src/feature/hs/hs_client.c b/src/feature/hs/hs_client.c
index c65f857419..e25919ecb7 100644
--- a/src/feature/hs/hs_client.c
+++ b/src/feature/hs/hs_client.c
@@ -29,6 +29,7 @@
 #include "feature/hs/hs_descriptor.h"
 #include "feature/hs/hs_ident.h"
 #include "feature/nodelist/describe.h"
+#include "feature/nodelist/microdesc.h"
 #include "feature/nodelist/networkstatus.h"
 #include "feature/nodelist/nodelist.h"
 #include "feature/nodelist/routerset.h"
@@ -1181,9 +1182,10 @@ can_client_refetch_desc(const ed25519_public_key_t *identity_pk,
     goto cannot;
   }
 
-  /* Without a live consensus we can't do any client actions. It is needed to
-   * compute the hashring for a service. */
-  if (!networkstatus_get_live_consensus(approx_time())) {
+  /* Without a usable consensus we can't do any client actions. It is needed
+   * to compute the hashring for a service. */
+  if (!networkstatus_get_reasonably_live_consensus(approx_time(),
+                                         usable_consensus_flavor())) {
     log_info(LD_REND, "Can't fetch descriptor for service %s because we "
                       "are missing a live consensus. Stalling connection.",
              safe_str_client(ed25519_fmt(identity_pk)));
diff --git a/src/feature/hs/hs_common.c b/src/feature/hs/hs_common.c
index ebe49f09a5..de653037d1 100644
--- a/src/feature/hs/hs_common.c
+++ b/src/feature/hs/hs_common.c
@@ -25,6 +25,7 @@
 #include "feature/hs/hs_service.h"
 #include "feature/hs_common/shared_random_client.h"
 #include "feature/nodelist/describe.h"
+#include "feature/nodelist/microdesc.h"
 #include "feature/nodelist/networkstatus.h"
 #include "feature/nodelist/nodelist.h"
 #include "feature/nodelist/routerset.h"
@@ -272,7 +273,9 @@ hs_get_time_period_num(time_t now)
   if (now != 0) {
     current_time = now;
   } else {
-    networkstatus_t *ns = networkstatus_get_live_consensus(approx_time());
+    networkstatus_t *ns =
+      networkstatus_get_reasonably_live_consensus(approx_time(),
+                                                  usable_consensus_flavor());
     current_time = ns ? ns->valid_after : approx_time();
   }
 
@@ -1098,7 +1101,8 @@ hs_in_period_between_tp_and_srv,(const networkstatus_t *consensus, time_t now))
   time_t srv_start_time, tp_start_time;
 
   if (!consensus) {
-    consensus = networkstatus_get_live_consensus(now);
+    consensus = networkstatus_get_reasonably_live_consensus(now,
+                                                  usable_consensus_flavor());
     if (!consensus) {
       return 0;
     }
@@ -1343,7 +1347,9 @@ hs_get_responsible_hsdirs(const ed25519_public_key_t *blinded_pk,
   sorted_nodes = smartlist_new();
 
   /* Make sure we actually have a live consensus */
-  networkstatus_t *c = networkstatus_get_live_consensus(approx_time());
+  networkstatus_t *c =
+    networkstatus_get_reasonably_live_consensus(approx_time(),
+                                                usable_consensus_flavor());
   if (!c || smartlist_len(c->routerstatus_list) == 0) {
       log_warn(LD_REND, "No live consensus so we can't get the responsible "
                "hidden service directories.");
diff --git a/src/feature/hs/hs_service.c b/src/feature/hs/hs_service.c
index 6d32cae86c..e820ce9d0b 100644
--- a/src/feature/hs/hs_service.c
+++ b/src/feature/hs/hs_service.c
@@ -23,6 +23,7 @@
 #include "feature/hs_common/shared_random_client.h"
 #include "feature/keymgt/loadkey.h"
 #include "feature/nodelist/describe.h"
+#include "feature/nodelist/microdesc.h"
 #include "feature/nodelist/networkstatus.h"
 #include "feature/nodelist/nickname.h"
 #include "feature/nodelist/node_select.h"
@@ -2500,7 +2501,8 @@ should_rotate_descriptors(hs_service_t *service, time_t now)
 
   tor_assert(service);
 
-  ns = networkstatus_get_live_consensus(now);
+  ns = networkstatus_get_reasonably_live_consensus(now,
+                                                   usable_consensus_flavor());
   if (ns == NULL) {
     goto no_rotation;
   }
@@ -3100,7 +3102,8 @@ should_service_upload_descriptor(const hs_service_t *service,
   }
 
   /* Don't upload desc if we don't have a live consensus */
-  if (!networkstatus_get_live_consensus(now)) {
+  if (!networkstatus_get_reasonably_live_consensus(now,
+                                            usable_consensus_flavor())) {
     goto cannot;
   }