mirrors/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2025-02-25 07:07:52 +01:00
Code Issues Projects Releases Wiki Activity

Merge branch 'maint-0.3.5' into maint-0.4.3

Browse source
This commit is contained in:
David Goulet 2021-02-03 08:51:36 -05:00
commit 0f8195406e
2 changed files with 18 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/core/or/connection_edge.c
View file

@ -4149,6 +4149,15 @@ my_exit_policy_rejects(const tor_addr_t *addr,
return 0;
}
/** Return true iff the consensus allows network reentry. The default value is
* false if the parameter is not found. */
static bool
network_reentry_is_allowed(void)
{
/* Default is false, re-entry is not allowed. */
return !!networkstatus_get_param(NULL, "allow-network-reentry", 0, 0, 1);
}
/** Connect to conn's specified addr and port. If it worked, conn
* has now been added to the connection_array.
*
@ -4186,6 +4195,8 @@ connection_exit_connect(edge_connection_t *edge_conn)
* infinite-length circuits (see "A Practical Congestion Attack on Tor Using
* Long Paths", Usenix Security 2009). See also ticket 2667.
*
* Skip this if the network reentry is allowed (known from the consensus).
*
* The TORPROTOCOL reason is used instead of EXITPOLICY so client do NOT
* attempt to retry connecting onto another circuit that will also fail
* bringing considerable more load on the network if so.
@ -4196,6 +4207,7 @@ connection_exit_connect(edge_connection_t *edge_conn)
* reason that makes the client retry results in much worst consequences in
* case of an attack so this is a small price to pay. */
if (!connection_edge_is_rendezvous_stream(edge_conn) &&
!network_reentry_is_allowed() &&
nodelist_reentry_probably_contains(&conn->addr, conn->port)) {
log_info(LD_EXIT, "%s:%d tried to connect back to a known relay address. "
"Closing.", escaped_safe_str_client(conn->address),

8
src/feature/nodelist/nodelist.c
View file

@ -674,8 +674,12 @@ nodelist_set_consensus(networkstatus_t *ns)
address_set_free(the_nodelist->node_addrs);
addr_port_set_free(the_nodelist->reentry_set);
the_nodelist->node_addrs = address_set_new(estimated_addresses);
/* Times two here is for both the ORPort and DirPort. */
the_nodelist->reentry_set = addr_port_set_new(estimated_addresses * 2);
/* Times two here is for both the ORPort and DirPort. We double it again in
* order to minimize as much as possible the false positive when looking up
* this set. Reason is that Exit streams that are legitimate but end up a
* false positive against this set will thus be considered reentry and be
* rejected which means a bad UX. */
the_nodelist->reentry_set = addr_port_set_new(estimated_addresses * 2 * 2);
SMARTLIST_FOREACH_BEGIN(ns->routerstatus_list, routerstatus_t *, rs) {
node_t *node = node_get_or_create(rs->identity_digest);