summaryrefslogtreecommitdiff
path: root/src/or
diff options
context:
space:
mode:
Diffstat (limited to 'src/or')
-rw-r--r--src/or/or.h3
-rw-r--r--src/or/rendmid.c13
2 files changed, 16 insertions, 0 deletions
diff --git a/src/or/or.h b/src/or/or.h
index 1609587717..adf3cfa866 100644
--- a/src/or/or.h
+++ b/src/or/or.h
@@ -3186,6 +3186,9 @@ typedef struct or_circuit_t {
* to the specification? */
unsigned int remaining_relay_early_cells : 4;
+ /* We have already received an INTRODUCE1 cell on this circuit. */
+ unsigned int already_received_introduce1 : 1;
+
/** True iff this circuit was made with a CREATE_FAST cell. */
unsigned int is_first_hop : 1;
diff --git a/src/or/rendmid.c b/src/or/rendmid.c
index d89cdf6bed..48bab19286 100644
--- a/src/or/rendmid.c
+++ b/src/or/rendmid.c
@@ -149,6 +149,19 @@ rend_mid_introduce(or_circuit_t *circ, const uint8_t *request,
goto err;
}
+ /* We have already done an introduction on this circuit but we just
+ received a request for another one. We block it since this might
+ be an attempt to DoS a hidden service (#15515). */
+ if (circ->already_received_introduce1) {
+ log_fn(LOG_PROTOCOL_WARN, LD_REND,
+ "Blocking multiple introductions on the same circuit. "
+ "Someone might be trying to attack a hidden service through "
+ "this relay.");
+ goto err;
+ }
+
+ circ->already_received_introduce1 = 1;
+
/* We could change this to MAX_HEX_NICKNAME_LEN now that 0.0.9.x is
* obsolete; however, there isn't much reason to do so, and we're going
* to revise this protocol anyway.