commit f7a3cdc8f27c2306cf06d742af63846c82ebdc56 Author: Sebastian Hahn <sebastian@torproject.org> Date: Wed Mar 9 11:34:04 2011 +0100 Use observed instead of declared uptime for HSDir It is important to verify the uptime claim of a relay instead of just trusting it, otherwise it becomes too easy to blackhole a specific hidden service. rephist already has data available that we can use here. Bugfix on 0.2.0.10-alpha. --- changes/hsdir_assignment | 7 +++++++ src/or/dirserv.c | 19 ++++++++++++++++++- src/or/rephist.c | 14 ++++++++++++++ src/or/rephist.h | 1 + 4 files changed, 40 insertions(+), 1 deletions(-) diff --git a/changes/hsdir_assignment b/changes/hsdir_assignment new file mode 100644 index 0000000..ba01990 --- /dev/null +++ b/changes/hsdir_assignment @@ -0,0 +1,7 @@ + o Security fixes: + - Directory authorities now use data collected from rephist when + choosing whether to assign the HSDir flag to relays, instead of + trusting the uptime value the relay reports in its descriptor. + This helps prevent an attack where relatively few malaicious + nodes can blackhole any given hidden service. Bugfix on + 0.2.0.10-alpha; fixes bug 2709. diff --git a/src/or/dirserv.c b/src/or/dirserv.c index aeeab45..40136a1 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -43,6 +43,8 @@ extern time_t time_of_process_start; /* from main.c */ +extern long stats_n_seconds_working; /* from main.c */ + /** Do we need to regenerate the v1 directory when someone asks for it? */ static time_t the_directory_is_dirty = 1; /** Do we need to regenerate the v1 runningrouters document when somebody @@ -1775,7 +1777,22 @@ dirserv_thinks_router_is_unreliable(time_t now, static int dirserv_thinks_router_is_hs_dir(routerinfo_t *router, time_t now) { - long uptime = real_uptime(router, now); + + long uptime; + + /* If we haven't been running for at least + * get_options()->MinUptimeHidServDirectoryV2 seconds, we can't + * have accurate data telling us a relay has been up for at least + * that long. We also want to allow a bit of slack: Reachability + * tests aren't instant. If we haven't been running long enough, + * trust the relay. */ + + if (stats_n_seconds_working > + get_options()->MinUptimeHidServDirectoryV2 * 1.1) + uptime = MIN(rep_hist_get_uptime(router->cache_info.identity_digest, now), + real_uptime(router, now)); + else + uptime = real_uptime(router, now); /* XXX We shouldn't need to check dir_port, but we do because of * bug 1693. In the future, once relays set wants_to_be_hs_dir diff --git a/src/or/rephist.c b/src/or/rephist.c index 53214d6..69001de 100644 --- a/src/or/rephist.c +++ b/src/or/rephist.c @@ -528,6 +528,20 @@ get_weighted_fractional_uptime(or_history_t *hist, time_t when) return ((double) up) / total; } +/** Return how long the router whose identity digest is <b>id</b> has + * been reachable. Return 0 if the router is unknown or currently deemed + * unreachable. */ +long +rep_hist_get_uptime(const char *id, time_t when) +{ + or_history_t *hist = get_or_history(id); + if (!hist) + return 0; + if (!hist->start_of_run) + return 0; + return when - hist->start_of_run; +} + /** Return an estimated MTBF for the router whose identity digest is * <b>id</b>. Return 0 if the router is unknown. */ double diff --git a/src/or/rephist.h b/src/or/rephist.h index 5f6b9f9..b06a39e 100644 --- a/src/or/rephist.h +++ b/src/or/rephist.h @@ -40,6 +40,7 @@ int rep_hist_record_mtbf_data(time_t now, int missing_means_down); int rep_hist_load_mtbf_data(time_t now); time_t rep_hist_downrate_old_runs(time_t now); +long rep_hist_get_uptime(const char *id, time_t when); double rep_hist_get_stability(const char *id, time_t when); double rep_hist_get_weighted_fractional_uptime(const char *id, time_t when); long rep_hist_get_weighted_time_known(const char *id, time_t when);