tor: enable PoW defenses for automatically created hidden services #33414
Conversation
Enable PoW defenses [1] for hidden services that we create via Tor Control using the `ADD_ONION` command [2]. The ability to do that has been added in tor-0.4.9.2-alpha [3]. Previous versions return a syntax error to the `ADD_ONION` command with `PoWDefensesEnabled=1`, so the approach here is to try with PoW and if we get syntax error, then retry without PoW. [1] https://tpo.pages.torproject.net/onion-services/ecosystem/technology/security/pow/ [2] https://spec.torproject.org/control-spec/commands.html#add_onion [3] https://gitlab.torproject.org/tpo/core/tor/-/commit/02c18044464bfe45f168b55297a785244094cfd5
|
The following sections might be updated with supplementary metadata relevant to reviewers and maintainers. Code Coverage & BenchmarksFor details see: https://corecheck.dev/bitcoin/bitcoin/pulls/33414. ReviewsSee the guideline for information on the review process. ConflictsReviewers, this pull request conflicts with the following ones:
If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first. |
|
Should we then also add PoW to the connections that we make to other nodes running behind hidden services? |
Reading the linked FAQ, the feature still supports "older clients" (which don't have PoW defence capability), but they may take a lower priority when a service considers itself under DoS. So no PoW is required on the client side. When the client-side tor is new-enough, my understanding is that the puzzle-solving is automatically handled by Tor, and doesn't need client-side changes to the connection code, as it happens during the introduction. But I am not 100% certain. |
|
@laanwj you might have some thoughts here? |
|
🐙 This pull request conflicts with the target branch and needs rebase. |
Enable PoW defenses for hidden services that we create via Tor Control using the
ADD_ONIONcommand.The ability to do that has been added in tor-0.4.9.2-alpha. Previous versions return a syntax error to the
ADD_ONIONcommand withPoWDefensesEnabled=1, so the approach here is to try with PoW and if we get syntax error, then retry without PoW.Also update
doc/tor.mdwith a hint on enabling PoW on manually configured Tor hidden services.