[tor-bugs] #21155 [Core Tor/Tor]: Similar to #14917: Client's choice of rend point can leak info about guard(s) of misconfigured hidden services with EntryNodes option

[Tor Bug Tracker & Wiki]

#21155: Similar to #14917: Client's choice of rend point can leak info about
guard(s) of misconfigured hidden services with EntryNodes option
-------------------------------+------------------------------------
 Reporter:  Jaym               |          Owner:
     Type:  defect             |         Status:  new
 Priority:  Medium             |      Milestone:  Tor: 0.3.0.x-final
Component:  Core Tor/Tor       |        Version:
 Severity:  Normal             |     Resolution:
 Keywords:  tor-hs, tor-guard  |  Actual Points:
Parent ID:                     |         Points:
 Reviewer:                     |        Sponsor:
-------------------------------+------------------------------------

Comment (by dgoulet):

 First of all, I don't think an hidden service should ever have its
 `Family` set because also running as a relay is dangerous but hey seems we
 can't stop users from doing that. But the `/16` is also a serious
 problem...

 This is very tricky as it's easy for tor to check at startup if a family
 node is in `EntryNodes`. So that we can fix easily to prevent an operator
 doing a bad thing and refusing to start. Might not totally be that easy
 though if `EntryNodes` value requires a consensus to parse like a country
 for instance.

 The same `/16` check has to happen at runtime since client will ask to
 connect to a specific RP and if that RP happens to be in the `/16` of your
 `EntryNodes`, circuit won't build and the attacker learns very valuable
 information.

 I'm starting to think that at the very least, we should warn that setting
 up `EntryNodes` while being a hidden service can expose you more in some
 known or yet unknown ways....

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/21155#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online