From 8dba8a088d7c1402831ab5a7211a4a347a60ff7a Mon Sep 17 00:00:00 2001
From: George Kadianakis <desnacked@riseup.net>
Date: Wed, 1 Apr 2015 14:33:09 +0100
Subject: [PATCH 1/3] Block multiple introductions on the same intro circuit.

---
 changes/bug15515 |  4 ++++
 src/or/or.h      |  3 +++
 src/or/rendmid.c | 13 +++++++++++++
 3 files changed, 20 insertions(+)
 create mode 100644 changes/bug15515

diff --git a/changes/bug15515 b/changes/bug15515
new file mode 100644
index 0000000000..dda7c2fcd8
--- /dev/null
+++ b/changes/bug15515
@@ -0,0 +1,4 @@
+  o Minor features (DoS-resistance):
+    - Make it harder for attackers to overwhelm hidden services with
+      introductions, by blocking multiple introduction requests on the
+      same circuit. Resolves ticket #15515.
diff --git a/src/or/or.h b/src/or/or.h
index 34f055cf06..4459957a06 100644
--- a/src/or/or.h
+++ b/src/or/or.h
@@ -3157,6 +3157,9 @@ typedef struct or_circuit_t {
    * to the specification? */
   unsigned int remaining_relay_early_cells : 4;
 
+  /* We have already received an INTRODUCE1 cell on this circuit. */
+  unsigned int already_received_introduce1 : 1;
+
   /** True iff this circuit was made with a CREATE_FAST cell. */
   unsigned int is_first_hop : 1;
 
diff --git a/src/or/rendmid.c b/src/or/rendmid.c
index 1bd11f6dc0..2f75ffb204 100644
--- a/src/or/rendmid.c
+++ b/src/or/rendmid.c
@@ -149,6 +149,19 @@ rend_mid_introduce(or_circuit_t *circ, const uint8_t *request,
     goto err;
   }
 
+  /* We have already done an introduction on this circuit but we just
+     received a request for another one. We block it since this might
+     be an attempt to DoS a hidden service (#15515). */
+  if (circ->already_received_introduce1) {
+    log_fn(LOG_PROTOCOL_WARN, LD_REND,
+           "Blocking multiple introductions on the same circuit. "
+           "Someone might be trying to attack a hidden service through "
+           "this relay.");
+    goto err;
+  }
+
+  circ->already_received_introduce1 = 1;
+
   /* We could change this to MAX_HEX_NICKNAME_LEN now that 0.0.9.x is
    * obsolete; however, there isn't much reason to do so, and we're going
    * to revise this protocol anyway.

From bcb839387ef65c0a87ca0a6b7957c3062188c601 Mon Sep 17 00:00:00 2001
From: George Kadianakis <desnacked@riseup.net>
Date: Thu, 2 Apr 2015 13:38:52 +0100
Subject: [PATCH 2/3] ... and if we do get multiple INTRODUCE1s on a circuit,
 kill the circuit

(Sending a nak would be pointless.)

See ticket 15515 for discussion.
---
 src/or/rendmid.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/or/rendmid.c b/src/or/rendmid.c
index 2f75ffb204..0a005a6312 100644
--- a/src/or/rendmid.c
+++ b/src/or/rendmid.c
@@ -157,7 +157,8 @@ rend_mid_introduce(or_circuit_t *circ, const uint8_t *request,
            "Blocking multiple introductions on the same circuit. "
            "Someone might be trying to attack a hidden service through "
            "this relay.");
-    goto err;
+    circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_TORPROTOCOL);
+    return -1;
   }
 
   circ->already_received_introduce1 = 1;

From 929a8f199bc236c39794f675a7bb8ad00b155257 Mon Sep 17 00:00:00 2001
From: George Kadianakis <desnacked@riseup.net>
Date: Thu, 2 Apr 2015 15:58:33 +0100
Subject: [PATCH 3/3] Decrease the amount of rend circ relaunches for hidden
 services.

---
 changes/bug11447     | 5 +++++
 src/or/rendservice.c | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 changes/bug11447

diff --git a/changes/bug11447 b/changes/bug11447
new file mode 100644
index 0000000000..8cd4f5b467
--- /dev/null
+++ b/changes/bug11447
@@ -0,0 +1,5 @@
+  o Minor features (DoS-resistance):
+    - Decrease the amount of reattempts that a hidden service is
+      willing to perform when its rendezvous circuits fail. This
+      reduces the computational cost for hidden service under heavy
+      load. Resolves ticket #11447.
\ No newline at end of file
diff --git a/src/or/rendservice.c b/src/or/rendservice.c
index 6c934c8c12..4ae06dfb90 100644
--- a/src/or/rendservice.c
+++ b/src/or/rendservice.c
@@ -90,7 +90,7 @@ typedef struct rend_service_port_config_t {
 #define MAX_INTRO_CIRCS_PER_PERIOD 10
 /** How many times will a hidden service operator attempt to connect to
  * a requested rendezvous point before giving up? */
-#define MAX_REND_FAILURES 8
+#define MAX_REND_FAILURES 1
 /** How many seconds should we spend trying to connect to a requested
  * rendezvous point before giving up? */
 #define MAX_REND_TIMEOUT 30