From 07b3028db74af246ca98c2d3a86d5efde9aa33c2 Mon Sep 17 00:00:00 2001 From: David Goulet Date: Wed, 2 Sep 2015 14:53:39 +0200 Subject: Prohibit the use of one entry node with an HS In a nutshell, since a circuit can not exit at its entry point, it's very easy for an attacker to find the hidden service guard if only one EntryNodes is specified since for that guard, the HS will refuse to build a rendezvous circuit to it. For now, the best solution is to stop tor to allow a single EntryNodes for an hidden service. Fixes #14917 Signed-off-by: David Goulet --- src/or/config.c | 14 ++++++++++++++ src/or/routerset.c | 11 +++++++++++ src/or/routerset.h | 1 + 3 files changed, 26 insertions(+) (limited to 'src') diff --git a/src/or/config.c b/src/or/config.c index cb0abab613..02b3477eaf 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -3173,6 +3173,20 @@ options_validate(or_options_t *old_options, or_options_t *options, "http://freehaven.net/anonbib/#hs-attack06 for details."); } + if (routerset_is_list(options->EntryNodes) && + (routerset_len(options->EntryNodes) == 1) && + (options->RendConfigLines != NULL)) { + tor_asprintf(msg, + "You have one single EntryNodes and at least one hidden service " + "configured. This is bad because it's very easy to locate your " + "entry guard which can then lead to the deanonymization of your " + "hidden service -- for more details, see " + "https://trac.torproject.org/projects/tor/ticket/14917. " + "For this reason, the use of one EntryNodes with an hidden " + "service is prohibited until a better solution is found."); + return -1; + } + if (!options->LearnCircuitBuildTimeout && options->CircuitBuildTimeout && options->CircuitBuildTimeout < RECOMMENDED_MIN_CIRCUIT_BUILD_TIMEOUT) { log_warn(LD_CONFIG, diff --git a/src/or/routerset.c b/src/or/routerset.c index 99de11ed5e..9fe5dffdeb 100644 --- a/src/or/routerset.c +++ b/src/or/routerset.c @@ -162,6 +162,17 @@ routerset_is_empty(const routerset_t *set) return !set || smartlist_len(set->list) == 0; } +/** Return the number of entries in set. This does NOT return a + * negative value. */ +int +routerset_len(const routerset_t *set) +{ + if (!set) { + return 0; + } + return smartlist_len(set->list); +} + /** Helper. Return true iff set contains a router based on the other * provided fields. Return higher values for more specific subentries: a * single router is more specific than an address range of routers, which is diff --git a/src/or/routerset.h b/src/or/routerset.h index 8d41de8b6b..aca7c6e74e 100644 --- a/src/or/routerset.h +++ b/src/or/routerset.h @@ -38,6 +38,7 @@ void routerset_subtract_nodes(smartlist_t *out, char *routerset_to_string(const routerset_t *routerset); int routerset_equal(const routerset_t *old, const routerset_t *new); void routerset_free(routerset_t *routerset); +int routerset_len(const routerset_t *set); #ifdef ROUTERSET_PRIVATE STATIC char * routerset_get_countryname(const char *c); -- cgit v1.2.3-54-g00ecf