Implement proposal 204: ignore subdomains in hidden service addresses

Attached is a patch that implements proposal 204. The present version address Nick's comments made on https://lists.torproject.org/pipermail/tor-dev/2012-July/003723.html.

changed milestone to %Tor: 0.2.4.x-final

added component::core tor/tor milestone::Tor: 0.2.4.x-final priority::medium resolution::implemented status::closed tor-client type::enhancement labels

Trac:
0001-Implement-proposal-204-ignore-subdomains-in-hidden-s.patch

implement proposal 204; v2

Trac:
Status: new to needs_review

Looks good! Remaining issues from my email:

• Somebody should run this to make sure that it works. :)

Otherwise it looks fine to me.

Oh! Actually, this may break IsolateDestAddr.

There's a security issue to think about here: Should we allow connections to two vhosts on the same hidden service to share a circuit? I think the answer is "not by default."

Trac:
Milestone: N/A to Tor: 0.2.4.x-final

Trac:
Keywords: N/A deleted, tor-client added

Trac:
Component: Tor Client to Tor

After applying the patch on top of ee4182612f, I have made some tests using the following protocol:

Tor started through: src/or/tor RunAsDaemon 0 Log "info stdout" SafeLogging 0 SocksPort "127.0.0.1:9850 IsolateDestAddr"

Using curl to reach hidden services through: {{{curl -I --socks5-hostname 127.0.0.1:9850 http://idnxcnkne4qt76tg.onion/}}

1. http://idnxcnkne4qt76tg.onion/ → build circuit A
2. http://idnxcnkne4qt76tg.onion/ → reuse circuit A
3. http://first.idnxcnkne4qt76tg.onion/ → build circuit B
4. http://first.idnxcnkne4qt76tg.onion/ → reuse circuit B
5. http://idnxcnkne4qt76tg.onion/ → reuse circuit A
6. http://second.idnxcnkne4qt76tg.onion/ → build circuit C

So it looks like it does not break IsolateDestAddr. I have been unable to make sure of that by looking at the code, though. :(

Cool. I'll look at the code some more to figure out why it works. My guess now would be that the address getting changes is conn->address, and that edge_conn->original_dest_address (or whatever it's called: the one that circuit isolation looks at) is unchanged.

One last question if I may: when IsolateDestAddr isn't set, do requests like this share circuits? I wonder if for security maybe we should turn on IsolateDestAddr for all onion circuits no matter what.

Same tests without using IsolateDestAddr:

1. http://idnxcnkne4qt76tg.onion/ → build circuit A
2. http://idnxcnkne4qt76tg.onion/ → reuse circuit A
3. http://first.idnxcnkne4qt76tg.onion/ → reuse circuit A
4. http://first.idnxcnkne4qt76tg.onion/ → reuse circuit A
5. http://idnxcnkne4qt76tg.onion/ → reuse circuit A
6. http://second.idnxcnkne4qt76tg.onion/ → reuse circuit A

Great; after discussion with Roger, I believe this is correct and mergeable.

Trac:
Resolution: N/A to implemented
Status: needs_review to closed

(and it's merged now too)

closed

mentioned in issue #19757 (moved)

moved to tpo/core/tor#6344 (closed)