Commit f2b1eb1f authored by David Goulet's avatar David Goulet 🐼
Browse files

hs: Disallow single hop client circuit when introducing 



This will effectively also deny any bridge to be used as a single hop to the
introduction point since bridge do not authenticate like clients.

Fixes #24963

Signed-off-by: David Goulet's avatarDavid Goulet <dgoulet@torproject.org>
parent 91c7d395

changes/ticket24963

0 → 100644
+5 −0
Original line number Diff line number Diff line 
  o Minor feature (onion service):

    - Disallow single hop clients to introduce directly at the introduction

      point. We've removed Tor2web a while back and rendezvous are blocked at

      the relays. This is to remove load off the network from spammy clients.

      Close ticket 24963.

src/feature/hs/hs_intropoint.c

+9 −0
Original line number Diff line number Diff line
@@ -10,6 +10,7 @@ 


#include "core/or/or.h"

#include "app/config/config.h"

#include "core/or/channel.h"

#include "core/or/circuitlist.h"

#include "core/or/circuituse.h"

#include "core/or/relay.h"
@@ -546,6 +547,14 @@ circuit_is_suitable_for_introduce1(const or_circuit_t *circ) 
    return 0;

  }



  /* Disallow single hop client circuit. */

  if (channel_is_client(circ->p_chan)) {

    log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,

           "Single hop client was rejected while trying to introduce. "

           "Closing circuit.");

    return 0;

  }



  return 1;

}