[tor-bugs] #22689 [Core Tor/Tor]: hs: Stop intro points being used as single hop proxies

[Tor Bug Tracker & Wiki]

#22689: hs: Stop intro points being used as single hop proxies
-------------------------------------------------+-------------------------
 Reporter:  teor                                 |          Owner:  dgoulet
     Type:  defect                               |         Status:
                                                 |  needs_revision
 Priority:  Medium                               |      Milestone:  Tor:
                                                 |  unspecified
Component:  Core Tor/Tor                         |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  relay-safety, 033-triage-20180320,   |  Actual Points:
  033-removed-20180320                           |
Parent ID:  #17945                               |         Points:  0.5
 Reviewer:  teor                                 |        Sponsor:
-------------------------------------------------+-------------------------
Description changed by teor:

Old description:

> This prevents them knowing both the service and client IP addresses, and
> therefore being targets for network traffic logging, sybil, or hacking
> attacks.
>
> We need to implement the following checks:
> * if the introduction point was made using a direct connection (single
> onion services), refuse direct client connections,
> * if the rend point was made using a direct connection (custom client, no
> tor2web for HSv3), refuse direct service connections (single onion
> services).
>
> See #22688 for how this is done for HSDir3s using channel_is_client().
> The comments in that patch explain why it works.
>
> We could even refactor the common code out of
> connection_dir_is_anonymous() into connection_is_anonymous(), and avoid
> including channel[tls].h into directory.c.
>
> I'm not sure if I will get time to do this, so please feel free to take
> this ticket.

New description:

 This prevents them knowing both the service and client IP addresses, and
 therefore being targets for network traffic logging, sybil, or hacking
 attacks.

 We need to implement the following checks:
 * if the introduction point was made using a direct connection (single
 onion services), refuse direct client connections,
 * ~~if the rend point was made using a direct connection (custom client,
 no tor2web for HSv3), refuse direct service connections (single onion
 services).~~

 See #22688 for how this is done for HSDir3s using channel_is_client(). The
 comments in that patch explain why it works.

 We could even refactor the common code out of
 connection_dir_is_anonymous() into connection_is_anonymous(), and avoid
 including channel[tls].h into directory.c.

 I'm not sure if I will get time to do this, so please feel free to take
 this ticket.

--

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/22689#comment:25>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online