[tor-bugs] #13667 [Tor]: Prevent port scanning of hidden services

[Tor Bug Tracker & Wiki]

#13667: Prevent port scanning of hidden services
------------------------+------------------------------------------
     Reporter:  arma    |      Owner:
         Type:  defect  |     Status:  needs_review
     Priority:  major   |  Milestone:  Tor: 0.2.6.x-final
    Component:  Tor     |    Version:
   Resolution:          |   Keywords:  SponsorR tor-hs 025-backport
Actual Points:          |  Parent ID:
       Points:          |
------------------------+------------------------------------------
Changes (by dgoulet):

 * status:  needs_revision => needs_review


Comment:

 After discussion on IRC, 3 things came up that we want:

 1. Users are not terribly inconvenienced.
 2. Scanners cannot easily tell whether a port is firewalled or whether the
 service is down.
 3. Scanning requires a new circuit per port.

 The branch below addresses 1) and 3) since 2) is quite incompatible with
 1). The idea in comment:20 is not really working for any legitimate user
 since the circuit stays open and tor on the client side has no way of
 knowing that it should use a new circuit for a new port thus stalling
 until a timeout...

 Solution is to go back to the DONE + kill circuit idea.

 See {{{bug13667_025_v4}}}.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13667#comment:22>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online