Tor 0.4.9.1-alpha-dev
|
Implement denial of service mitigation for the onion service subsystem. More...
#include "core/or/or.h"
#include "app/config/config.h"
#include "core/or/circuitlist.h"
#include "feature/hs/hs_circuitmap.h"
#include "feature/nodelist/networkstatus.h"
#include "feature/relay/routermode.h"
#include "lib/evloop/token_bucket.h"
#include "lib/time/compat_time.h"
#include "feature/hs/hs_dos.h"
Go to the source code of this file.
Macros | |
#define | HS_DOS_PRIVATE |
#define | HS_DOS_INTRODUCE_DEFAULT_CELL_RATE_PER_SEC 25 |
#define | HS_DOS_INTRODUCE_DEFAULT_CELL_BURST_PER_SEC 200 |
#define | HS_DOS_INTRODUCE_ENABLED_DEFAULT 0 |
Functions | |
STATIC uint32_t | get_intro2_enable_consensus_param (const networkstatus_t *ns) |
STATIC uint32_t | get_intro2_rate_consensus_param (const networkstatus_t *ns) |
STATIC uint32_t | get_intro2_burst_consensus_param (const networkstatus_t *ns) |
static void | update_intro_circuits (void) |
static void | set_consensus_parameters (const networkstatus_t *ns) |
void | hs_dos_setup_default_intro2_defenses (or_circuit_t *circ) |
void | hs_dos_consensus_has_changed (const networkstatus_t *ns) |
bool | hs_dos_can_send_intro2 (or_circuit_t *s_intro_circ) |
uint64_t | hs_dos_get_intro2_rejected_count (void) |
void | hs_dos_init (void) |
Variables | |
static uint64_t | intro2_rejected_count = 0 |
static uint32_t | consensus_param_introduce_rate_per_sec |
static uint32_t | consensus_param_introduce_burst_per_sec |
static uint32_t | consensus_param_introduce_defense_enabled |
Implement denial of service mitigation for the onion service subsystem.
This module defenses:
Introduction Rate Limiting: If enabled by the consensus, an introduction point will rate limit client introduction towards the service (INTRODUCE2 cells). It uses a token bucket model with a rate and burst per second.
Proposal 305 will expand this module by allowing an operator to define these values into the ESTABLISH_INTRO cell. Not yet implemented.
Definition in file hs_dos.c.
#define HS_DOS_INTRODUCE_DEFAULT_CELL_BURST_PER_SEC 200 |
Default value of the allowed INTRODUCE2 cell burst per second. This is the maximum value a token bucket has per second. We thus allow up to this value of INTRODUCE2 cell per second but the bucket is refilled by the rate value but never goes above that burst value.
#define HS_DOS_INTRODUCE_DEFAULT_CELL_RATE_PER_SEC 25 |
#define HS_DOS_INTRODUCE_ENABLED_DEFAULT 0 |
STATIC uint32_t get_intro2_burst_consensus_param | ( | const networkstatus_t * | ns | ) |
STATIC uint32_t get_intro2_enable_consensus_param | ( | const networkstatus_t * | ns | ) |
STATIC uint32_t get_intro2_rate_consensus_param | ( | const networkstatus_t * | ns | ) |
bool hs_dos_can_send_intro2 | ( | or_circuit_t * | s_intro_circ | ) |
void hs_dos_consensus_has_changed | ( | const networkstatus_t * | ns | ) |
uint64_t hs_dos_get_intro2_rejected_count | ( | void | ) |
void hs_dos_init | ( | void | ) |
void hs_dos_setup_default_intro2_defenses | ( | or_circuit_t * | circ | ) |
|
static |
Set consensus parameters.
Definition at line 116 of file hs_dos.c.
Referenced by hs_dos_consensus_has_changed(), and hs_dos_init().
|
static |
|
static |
|
static |
|
static |
|
static |
INTRODUCE2 rejected request counter.
Definition at line 50 of file hs_dos.c.
Referenced by hs_dos_get_intro2_rejected_count().