[tor-bugs] #21155 [- Select a component]: Similar to #14917: Client's choice of rend point can leak info about guard(s) of misconfigured hidden services with EntryNodes option

[Tor Bug Tracker & Wiki]

#21155: Similar to #14917: Client's choice of rend point can leak info about
guard(s) of misconfigured hidden services with EntryNodes option
--------------------------------------+------------------------------
     Reporter:  Jaym                  |      Owner:
         Type:  defect                |     Status:  new
     Priority:  Medium                |  Milestone:
    Component:  - Select a component  |    Version:  Tor: unspecified
     Severity:  Normal                |   Keywords:
Actual Points:                        |  Parent ID:
       Points:                        |   Reviewer:
      Sponsor:                        |
--------------------------------------+------------------------------
 Hello !

 I discovered #14917 while configuring an onion service with the EntryNodes
 option set. I believe (after checking the tor-0.2.9.8 source code) that a
 similar problem arises when the EntryNodes option is set AND the operator
 configures entry nodes that are part of the same family or the same /16.
 (let's say that the operator configures the service with 2 of its own
 guard nodes running in the same cloud provider, thinking this move is
 wise). Then this happens:

 - When someone use a RDV point of the same family or the same /16 than the
 onion's guards, then as you said: "entry_list_is_constrained() is true, so
 populate_live_entry_guards() will happily return an empty list if your one
 choice is inappropriate, resulting in choose_random_entry_impl() returning
 NULL".

 Is there a reason why we do not check family, /16 and user
 misconfiguration ? "EntryNodes fingerprint1, fingerprint1" works just fine
 for example. What do you think ?

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/21155>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online