Say I've started a hidden service and forwarded ports 80 and 22 in /etc/tor/torrc. Without querying port 22, is it logistically possible to assess my hidden service and establish that port 22 is open?
In other words, would it be possible to retrieve the raw hidden service descriptor from an the distributed hash table and extract port information from it? How?
No, it cannot be detected without actually trying to connect.
The descriptor can easily be retrieved but it does not contain port information. You can see the details of the descriptor content in the specification for the rendezvous protocol.
There is even a mechanism to frustrate attempts to bruteforce, which is enabled by default.
HiddenServiceAllowUnknownPorts 0|1 If set to 1, then connections to unrecognized ports do not cause the current hidden service to close rendezvous circuits. (Setting this to 0 is not an authorization mechanism; it is instead meant to be a mild inconvenience to port-scanners.) (Default: 0)
If someone tries to connect to a port that isn't "open", the whole rendezvous circuit is dropped and they have to rebuild one for each unsuccessful guess.
