nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-24 04:13:28 +01:00
Code Issues Packages Projects Releases Wiki Activity

clients defend themselves from absurd pow requests

Browse Source 
if asked for higher than a cap, we just solve it at the cap

i picked 500 for now but maybe we'll pick a better number in the future.
This commit is contained in:
Roger Dingledine 2022-07-01 18:32:04 -04:00 committed by Micah Elizabeth Scott
parent ec7495d35a
commit e605620744
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/feature/hs/hs_client.c
View File

@ -600,6 +600,10 @@ find_desc_intro_point_by_legacy_id(const char *legacy_id,
return ret_ip; return ret_ip;
} }
/** Set a client-side cap on the highest effort of PoW we will try to
* tackle. If asked for higher, we solve it at this cap. */
#define CLIENT_MAX_POW_EFFORT 500
/** Send an INTRODUCE1 cell along the intro circuit and populate the rend /** Send an INTRODUCE1 cell along the intro circuit and populate the rend
* circuit identifier with the needed key material for the e2e encryption. * circuit identifier with the needed key material for the e2e encryption.
* Return 0 on success, -1 if there is a transient error such that an action * Return 0 on success, -1 if there is a transient error such that an action
@ -674,6 +678,20 @@ send_introduce1(origin_circuit_t *intro_circ,
if (desc->encrypted_data.pow_params) { if (desc->encrypted_data.pow_params) {
log_debug(LD_REND, "PoW params present in descriptor."); log_debug(LD_REND, "PoW params present in descriptor.");
pow_solution = tor_malloc_zero(sizeof(hs_pow_solution_t)); pow_solution = tor_malloc_zero(sizeof(hs_pow_solution_t));
/* make sure we can't be tricked into hopeless quests */
if (desc->encrypted_data.pow_params->suggested_effort >
CLIENT_MAX_POW_EFFORT) {
log_notice(LD_REND, "Onion service suggested effort %d which is "
"higher than we want to solve. Solving at %d instead.",
desc->encrypted_data.pow_params->suggested_effort,
CLIENT_MAX_POW_EFFORT);
/* clobber it in-place. hopefully this won't have bad side effects. */
desc->encrypted_data.pow_params->suggested_effort =
CLIENT_MAX_POW_EFFORT;
}
if (hs_pow_solve(desc->encrypted_data.pow_params, pow_solution)) { if (hs_pow_solve(desc->encrypted_data.pow_params, pow_solution)) {
log_warn(LD_REND, "Haven't solved the PoW yet."); log_warn(LD_REND, "Haven't solved the PoW yet.");
goto tran_err; goto tran_err;