[tor-bugs] #24487 [Core Tor/Tor]: Reverse path selection (choose outer hops first)

[Tor Bug Tracker & Wiki]

#24487: Reverse path selection (choose outer hops first)
------------------------------+--------------------------------
     Reporter:  mikeperry     |      Owner:  (none)
         Type:  defect        |     Status:  new
     Priority:  High          |  Milestone:  Tor: 0.3.3.x-final
    Component:  Core Tor/Tor  |    Version:
     Severity:  Normal        |   Keywords:  guard-discovery
Actual Points:                |  Parent ID:  #9001
       Points:                |   Reviewer:
      Sponsor:  SponsorV-can  |
------------------------------+--------------------------------
 Because Tor's path selection chooses inner nodes first, and then excludes
 those nodes from being used in outer hops, over many circuits, outer hops
 get information about the choice of inner hops/guards.

 We need to reverse the selection of nodes in the loop
 circuit_establish_circuit() in order to fix this.

 This isn't as bad as it might otherwise be, because the last hop already
 is chosen first in that function. So it is a little tricky to take
 advantage of this info leak.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/24487>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online