• David Goulet's avatar
    hs: Don't overwrite DoS parameters on circuit with consensus params · f5c9f6d4
    David Goulet authored
    
    
    Turns out that the HS DoS defenses parameters were overwritten by the
    consensus parameters everytime a new consensus would arrive.
    
    This means that a service operator can still enable the defenses but as soon
    as the intro point relay would get a new consensus, they would be overwritten.
    And at this commit, the network is entirely disabling DoS defenses.
    
    Fix this by introducing an "explicit" flag that indicate if the
    ESTABLISH_INTRO cell DoS extension set those parameters or not. If set, avoid
    using the consenus at once.
    
    We are not bumping the protover HSIntro value for this because 0.4.2.x series
    is EOL in 1 month and thus 0.4.3.x would be the only series with this bug. We
    are confident that a backport and then upgrade path to the latest 0.4.4.x
    stable coming up soon is enough to mitigate this problem in the coming months.
    
    It avoids the upgrade path on the service side by keeping the requirement for
    protover HSIntro=5.
    
    Fixes #40109
    Signed-off-by: David Goulet's avatarDavid Goulet <dgoulet@torproject.org>
    f5c9f6d4
hs_dos.c 7.72 KB