Disallow setting UseBridges to 1 and UseEntryGuards to 0

changes/bug20502

@@ -0,0 +1,5 @@
+  o Minor features
+    - Require UseEntryGuards when UseBridges is set in order to make sure
+      bridges aren't bypassed. Resolves ticket 20502.
+    - Add UseEntryGuards to TEST_OPTIONS_DEFAULT_VALUES in order to not break
+      regresson tests.

src/or/config.c

@@ -3372,6 +3372,11 @@ options_validate(or_options_t *old_options, or_options_t *options,
   if (options->UseBridges && options->EntryNodes)
     REJECT("You cannot set both UseBridges and EntryNodes.");
 
+  /* If we have UseBridges as 1 and UseEntryGuards as 0, we end up bypassing
+   * the use of bridges */
+  if (options->UseBridges && !options->UseEntryGuards)
+    REJECT("Setting UseBridges requires also setting UseEntryGuards.");
+
   options->MaxMemInQueues =
     compute_real_max_mem_in_queues(options->MaxMemInQueues_raw,
                                    server_mode(options));

src/test/test_options.c

@@ -333,7 +333,8 @@ fixed_get_uname(void)
   "VirtualAddrNetworkIPv4 127.192.0.0/10\n"                             \
   "VirtualAddrNetworkIPv6 [FE80::]/10\n"                                \
   "SchedulerHighWaterMark__ 42\n"                                       \
-  "SchedulerLowWaterMark__ 10\n"
+  "SchedulerLowWaterMark__ 10\n"                                        \
+  "UseEntryGuards 1\n"
 
 typedef struct {
   or_options_t *old_opt;
@@ -1934,6 +1935,19 @@ test_options_validate__use_bridges(void *ignored)
             "If you set UseBridges, you must specify at least one bridge.");
   tor_free(msg);
 
+  free_options_test_data(tdata);
+  tdata = get_options_test_data(TEST_OPTIONS_DEFAULT_VALUES
+                                "UseBridges 1\n"
+                                "Bridge 10.0.0.1\n"
+                                "UseEntryGuards 0\n"
+                                );
+
+  ret = options_validate(tdata->old_opt, tdata->opt, tdata->def_opt, 0, &msg);
+  tt_int_op(ret, OP_EQ, -1);
+  tt_str_op(msg, OP_EQ,
+            "Setting UseBridges requires also setting UseEntryGuards.");
+  tor_free(msg);
+
   free_options_test_data(tdata);
   tdata = get_options_test_data(TEST_OPTIONS_DEFAULT_VALUES
                                 "UseBridges 1\n"