mirrors/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2025-02-28 16:58:18 +01:00
Code Issues Projects Releases Wiki Activity
tor/src/feature/hs/hs_dos.h

43 lines
1.1 KiB
C
Raw Normal View History

hs: Limit the amount of relayed INTRODUCE2 This commit add the hs_dos.{c|h} file that has the purpose of having the anti-DoS code for onion services. At this commit, it only has one which is a function that decides if an INTRODUCE2 can be sent on the given introduction service circuit (S<->IP) using a simple token bucket. The rate per second is 25 and allowed burst to 200. Basic defenses on #15516. Signed-off-by: David Goulet <dgoulet@torproject.org>
2019-05-29 14:05:16 -04:00
/* Copyright (c) 2019, The Tor Project, Inc. */
/* See LICENSE for licensing information */
/**
* \file hs_dos.h
* \brief Header file containing denial of service defenses for the HS
* subsystem for all versions.
**/
#ifndef TOR_HS_DOS_H
#define TOR_HS_DOS_H
#include "core/or/or_circuit_st.h"
hs-v3: Add consensus parameters for DoS defenses Part of #15516 Signed-off-by: David Goulet <dgoulet@torproject.org>
2019-06-11 08:28:13 -04:00
#include "feature/nodelist/networkstatus_st.h"
hs: Limit the amount of relayed INTRODUCE2 This commit add the hs_dos.{c|h} file that has the purpose of having the anti-DoS code for onion services. At this commit, it only has one which is a function that decides if an INTRODUCE2 can be sent on the given introduction service circuit (S<->IP) using a simple token bucket. The rate per second is 25 and allowed burst to 200. Basic defenses on #15516. Signed-off-by: David Goulet <dgoulet@torproject.org>
2019-05-29 14:05:16 -04:00
hs-v3: Add consensus parameters for DoS defenses Part of #15516 Signed-off-by: David Goulet <dgoulet@torproject.org>
2019-06-11 08:28:13 -04:00
/* Init */
void hs_dos_init(void);
/* Consensus. */
void hs_dos_consensus_has_changed(const networkstatus_t *ns);
hs: Limit the amount of relayed INTRODUCE2 This commit add the hs_dos.{c|h} file that has the purpose of having the anti-DoS code for onion services. At this commit, it only has one which is a function that decides if an INTRODUCE2 can be sent on the given introduction service circuit (S<->IP) using a simple token bucket. The rate per second is 25 and allowed burst to 200. Basic defenses on #15516. Signed-off-by: David Goulet <dgoulet@torproject.org>
2019-05-29 14:05:16 -04:00
hs-v3: Rename INTRO2 consensus param getters Make it clear that these functions return the consensus param only. Introduction point can not set those values with a torrc option. Signed-off-by: David Goulet <dgoulet@torproject.org>
2019-08-12 12:32:38 -04:00
/* Introduction Point. */
hs: Limit the amount of relayed INTRODUCE2 This commit add the hs_dos.{c|h} file that has the purpose of having the anti-DoS code for onion services. At this commit, it only has one which is a function that decides if an INTRODUCE2 can be sent on the given introduction service circuit (S<->IP) using a simple token bucket. The rate per second is 25 and allowed burst to 200. Basic defenses on #15516. Signed-off-by: David Goulet <dgoulet@torproject.org>
2019-05-29 14:05:16 -04:00
bool hs_dos_can_send_intro2(or_circuit_t *s_intro_circ);
hs-v3: Move to hs_dos.c INTRO2 defenses initialization A bit cleaner especially that the next commit(s) will make the consensus param interface private to hs_dos.c so we expose as little as we can outside of the subsystem. Part of #30924 Signed-off-by: David Goulet <dgoulet@torproject.org>
2019-08-20 08:35:21 -04:00
void hs_dos_setup_default_intro2_defenses(or_circuit_t *circ);
hs: Limit the amount of relayed INTRODUCE2 This commit add the hs_dos.{c|h} file that has the purpose of having the anti-DoS code for onion services. At this commit, it only has one which is a function that decides if an INTRODUCE2 can be sent on the given introduction service circuit (S<->IP) using a simple token bucket. The rate per second is 25 and allowed burst to 200. Basic defenses on #15516. Signed-off-by: David Goulet <dgoulet@torproject.org>
2019-05-29 14:05:16 -04:00
dos: Add HS DoS INTRO2 rejected stats in heartbeat The DoS heartbeat now contains the number of rejected INTRODUCE2 cell that the relay has seen. Closes #31371 Signed-off-by: David Goulet <dgoulet@torproject.org>
2019-10-31 13:57:14 -04:00
/* Statistics. */
uint64_t hs_dos_get_intro2_rejected_count(void);
hs: Limit the amount of relayed INTRODUCE2 This commit add the hs_dos.{c|h} file that has the purpose of having the anti-DoS code for onion services. At this commit, it only has one which is a function that decides if an INTRODUCE2 can be sent on the given introduction service circuit (S<->IP) using a simple token bucket. The rate per second is 25 and allowed burst to 200. Basic defenses on #15516. Signed-off-by: David Goulet <dgoulet@torproject.org>
2019-05-29 14:05:16 -04:00
#ifdef HS_DOS_PRIVATE
#ifdef TOR_UNIT_TESTS
hs-v3: Privatize access to HS DoS consensus param Remove the public functions returning the HS DoS consensus param or default values as it is exclusively used internally now. Rename the param_* variables to consensus_param_* for better code semantic. Finally, make some private functions available to unit tests. Signed-off-by: David Goulet <dgoulet@torproject.org>
2019-08-20 08:52:34 -04:00
STATIC uint32_t get_intro2_enable_consensus_param(const networkstatus_t *ns);
STATIC uint32_t get_intro2_rate_consensus_param(const networkstatus_t *ns);
STATIC uint32_t get_intro2_burst_consensus_param(const networkstatus_t *ns);
Run "make autostyle" and fix wide lines.
2019-09-16 13:27:42 -04:00
#endif /* defined(TOR_UNIT_TESTS) */
hs: Limit the amount of relayed INTRODUCE2 This commit add the hs_dos.{c|h} file that has the purpose of having the anti-DoS code for onion services. At this commit, it only has one which is a function that decides if an INTRODUCE2 can be sent on the given introduction service circuit (S<->IP) using a simple token bucket. The rate per second is 25 and allowed burst to 200. Basic defenses on #15516. Signed-off-by: David Goulet <dgoulet@torproject.org>
2019-05-29 14:05:16 -04:00
#endif /* defined(HS_DOS_PRIVATE) */
#endif /* !defined(TOR_HS_DOS_H) */
Reference in a new issue Copy permalink