From f5c9f6d4327d7dcd36081426c0a862b6a06a2b61 Mon Sep 17 00:00:00 2001 From: David Goulet Date: Wed, 19 Aug 2020 09:47:34 -0400 Subject: hs: Don't overwrite DoS parameters on circuit with consensus params Turns out that the HS DoS defenses parameters were overwritten by the consensus parameters everytime a new consensus would arrive. This means that a service operator can still enable the defenses but as soon as the intro point relay would get a new consensus, they would be overwritten. And at this commit, the network is entirely disabling DoS defenses. Fix this by introducing an "explicit" flag that indicate if the ESTABLISH_INTRO cell DoS extension set those parameters or not. If set, avoid using the consenus at once. We are not bumping the protover HSIntro value for this because 0.4.2.x series is EOL in 1 month and thus 0.4.3.x would be the only series with this bug. We are confident that a backport and then upgrade path to the latest 0.4.4.x stable coming up soon is enough to mitigate this problem in the coming months. It avoids the upgrade path on the service side by keeping the requirement for protover HSIntro=5. Fixes #40109 Signed-off-by: David Goulet --- changes/ticket40109 | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 changes/ticket40109 (limited to 'changes') diff --git a/changes/ticket40109 b/changes/ticket40109 new file mode 100644 index 0000000000..d99db65aa4 --- /dev/null +++ b/changes/ticket40109 @@ -0,0 +1,6 @@ + o Major bugfixes (onion services, DoS): + - The consensus parameters for the onion service DoS defenses was + overwriting the circuit parameters that could have been set by the service + operator using HiddenServiceEnableIntroDoSDefense. Fixes bug 40109; bugfix + on 0.4.2.1-alpha. + -- cgit v1.2.3-54-g00ecf