relay: Add bloomfiter of relay address + {OR|Dir}Port

In order to deny re-entry in the network, we now keep a bloomfilter of relay
ORPort + address and authorities ORPort + address and DirPort + address
combinations.

So when an Exit stream is handled, we deny anything connecting back into the
network on the ORPorts for relays and on the ORPort+DirPort for the
authorities.

Related to #2667

Signed-off-by: David Goulet <dgoulet@torproject.org>

1 files changed, 6 insertions, 3 deletions

diff --git a/src/feature/nodelist/dirlist.c b/src/feature/nodelist/dirlist.c
index 576a6a2e49..423c4106e2 100644
--- a/src/feature/nodelist/dirlist.c
+++ b/src/feature/nodelist/dirlist.c
@@ -58,10 +58,13 @@ add_trusted_dir_to_nodelist_addr_set(const dir_server_t *dir)
   tor_assert(dir);
   tor_assert(dir->is_authority);
 
-  /* Add IPv4 and then IPv6 if applicable. */
-  nodelist_add_addr_to_address_set(&dir->ipv4_addr);
+  /* Add IPv4 and then IPv6 if applicable. For authorities, we add the ORPort
+   * and DirPort so re-entry into the network back to them is not possible. */
+  nodelist_add_addr_to_address_set(&dir->ipv4_addr, dir->ipv4_orport,
+                                   dir->ipv4_dirport);
   if (!tor_addr_is_null(&dir->ipv6_addr)) {
-    nodelist_add_addr_to_address_set(&dir->ipv6_addr);
+    /* IPv6 DirPort is not a thing yet for authorities. */
+    nodelist_add_addr_to_address_set(&dir->ipv6_addr, dir->ipv6_orport, 0);
   }
 }