commit b10e5ac7b86c459a62cfc316c8be87143d2a87e4
Author: Nick Mathewson <nickm(a)torproject.org>
Date: Mon Nov 3 14:02:47 2014 -0500
Check descriptor ID in addition to HS ID when saving a v2 hs descriptor
Fixes bug 13214; reported by 'special'.
---
changes/bug13214 | 7 +++++++
src/or/directory.c | 3 ++-
src/or/rendcommon.c | 19 +++++++++++++++++++
src/or/rendcommon.h | 1 +
4 files changed, 29 insertions(+), 1 deletion(-)
diff --git a/changes/bug13214 b/changes/bug13214
new file mode 100644
index 0000000..5b9758b
--- /dev/null
+++ b/changes/bug13214
@@ -0,0 +1,7 @@
+ o Minor bugfixes (hidden services):
+ - When fetching hidden service descriptors, check not only for
+ whether we got the hidden service we had in mind, but also
+ whether we got the particular descriptors we wanted. This
+ prevents a class of inefficient but annoying DoS attacks by
+ hidden service directories. Fixes bug 13214; bugfix on
+ 0.2.1.6-alpha. Reported by "special".
diff --git a/src/or/directory.c b/src/or/directory.c
index 298271f..d429b7b 100644
--- a/src/or/directory.c
+++ b/src/or/directory.c
@@ -2082,7 +2082,8 @@ connection_dir_client_reached_eof(dir_connection_t *conn)
(int)body_len, status_code, escaped(reason));
switch (status_code) {
case 200:
- switch (rend_cache_store_v2_desc_as_client(body, conn->rend_data)) {
+ switch (rend_cache_store_v2_desc_as_client(body,
+ conn->requested_resource, conn->rend_data)) {
case RCS_BADDESC:
case RCS_NOTDIR: /* Impossible */
log_warn(LD_REND,"Fetching v2 rendezvous descriptor failed. "
diff --git a/src/or/rendcommon.c b/src/or/rendcommon.c
index a664b5d..e95cf48 100644
--- a/src/or/rendcommon.c
+++ b/src/or/rendcommon.c
@@ -1034,10 +1034,14 @@ rend_cache_store_v2_desc_as_dir(const char *desc)
* If the descriptor's service ID does not match
* <b>rend_query</b>-\>onion_address, reject it.
*
+ * If the descriptor's descriptor ID doesn't match <b>desc_id_base32</b>,
+ * reject it.
+ *
* Return an appropriate rend_cache_store_status_t.
*/
rend_cache_store_status_t
rend_cache_store_v2_desc_as_client(const char *desc,
+ const char *desc_id_base32,
const rend_data_t *rend_query)
{
/*XXXX this seems to have a bit of duplicate code with
@@ -1064,10 +1068,19 @@ rend_cache_store_v2_desc_as_client(const char *desc,
time_t now = time(NULL);
char key[REND_SERVICE_ID_LEN_BASE32+2];
char service_id[REND_SERVICE_ID_LEN_BASE32+1];
+ char want_desc_id[DIGEST_LEN];
rend_cache_entry_t *e;
rend_cache_store_status_t retval = RCS_BADDESC;
tor_assert(rend_cache);
tor_assert(desc);
+ tor_assert(desc_id_base32);
+ memset(want_desc_id, 0, sizeof(want_desc_id));
+ if (base32_decode(want_desc_id, sizeof(want_desc_id),
+ desc_id_base32, strlen(desc_id_base32)) != 0) {
+ log_warn(LD_BUG, "Couldn't decode base32 %s for descriptor id.",
+ escaped_safe_str_client(desc_id_base32));
+ goto err;
+ }
/* Parse the descriptor. */
if (rend_parse_v2_service_descriptor(&parsed, desc_id, &intro_content,
&intro_size, &encoded_size,
@@ -1086,6 +1099,12 @@ rend_cache_store_v2_desc_as_client(const char *desc,
service_id, safe_str(rend_query->onion_address));
goto err;
}
+ if (tor_memneq(desc_id, want_desc_id, DIGEST_LEN)) {
+ log_warn(LD_REND, "Received service descriptor for %s with incorrect "
+ "descriptor ID.", service_id);
+ goto err;
+ }
+
/* Decode/decrypt introduction points. */
if (intro_content) {
int n_intro_points;
diff --git a/src/or/rendcommon.h b/src/or/rendcommon.h
index 07a47ac..42a089a 100644
--- a/src/or/rendcommon.h
+++ b/src/or/rendcommon.h
@@ -49,6 +49,7 @@ typedef enum {
rend_cache_store_status_t rend_cache_store_v2_desc_as_dir(const char *desc);
rend_cache_store_status_t rend_cache_store_v2_desc_as_client(const char *desc,
+ const char *desc_id_base32,
const rend_data_t *rend_query);
int rend_encode_v2_descriptors(smartlist_t *descs_out,