[tor-bugs] #24509 [Core Tor/Tor]: circuit_can_use_tap() should only allow TAP for v2 onion services

[Tor Bug Tracker & Wiki]

#24509: circuit_can_use_tap() should only allow TAP for v2 onion services
-------------------------------------------------+-------------------------
 Reporter:  teor                                 |          Owner:  dgoulet
     Type:  defect                               |         Status:
                                                 |  needs_revision
 Priority:  Medium                               |      Milestone:  Tor:
                                                 |  0.3.3.x-final
Component:  Core Tor/Tor                         |        Version:  Tor:
                                                 |  0.3.2.1-alpha
 Severity:  Normal                               |     Resolution:
 Keywords:  prop224, tor-hs, security-low,       |  Actual Points:
  easy, intro                                    |
Parent ID:                                       |         Points:  0.5
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------
Changes (by teor):

 * status:  needs_information => needs_revision


Comment:

 Replying to [comment:10 dgoulet]:
 > I was working on this and I started to wonder here why isn't the purpose
 + the presence of a TAP onion key in the extend_info_t object not enough
 to rule out v2 HS?

 This check is a defence in depth mechanism.

 > As an example, HSv3 never sets a TAP onion key so it can simply never
 hit true there. Is the goal to have an _explicit_ flag that identifies the
 circuits HS version? Tbh, just to have that, it requires quite a bit of
 gymnastic and added flags for some gain I'm not sure I understand?

 It makes sure that our v3 code never uses TAP.
 And that our v2 code only uses TAP for two specific purposes: client
 intro, and service rend.

 These checks make it easier to get rid of TAP, because we know we're not
 accidentally using it for anything else. And they make sure we can't be
 *tricked* into using it for anything else, if there are bugs in our code.

 > A straight forward way would be to add a flag to the `extend_info_t` so
 the v2 and v3 subsystem can put the right version in there. But how is
 that different from "setting a TAP key" and "not setting a tap key" ?

 If there are bugs in our code, it is different.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/24509#comment:12>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online