Patch from lark: drop BEGIN cells from a rendevous circuit if they do not originate from the end of the circuit.

svn:r18667

1 files changed, 7 insertions, 0 deletions

diff --git a/src/or/relay.c b/src/or/relay.c
index 0c607f04f7..a6a8fef707 100644
--- a/src/or/relay.c
+++ b/src/or/relay.c
@@ -1019,6 +1019,13 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ,
                "Relay begin request unsupported at AP. Dropping.");
         return 0;
       }
+      if (circ->purpose == CIRCUIT_PURPOSE_S_REND_JOINED &&
+          layer_hint != TO_ORIGIN_CIRCUIT(circ)->cpath->prev) {
+        log_fn(LOG_PROTOCOL_WARN, LD_APP,
+               "Relay begin request to Hidden Service "
+               "from intermediary node. Dropping.");
+        return 0;
+      }
       if (conn) {
         log_fn(LOG_PROTOCOL_WARN, domain,
                "Begin cell for known stream. Dropping.");