February 2018 - tor-commits - lists.torproject.org

[tor/release-0.3.3] Merge remote-tracking branch 'dgoulet/ticket24902_029_05' into maint-0.2.9
by nickm＠torproject.org 16 Feb '18

16 Feb '18

1 0

[tor/release-0.3.3] Merge branch 'maint-0.3.1' into maint-0.3.2
by nickm＠torproject.org 16 Feb '18

16 Feb '18

commit bd71e0a0c8ccf684c40201f08c456596eac60887 Merge: c67adddac 2bcd264a2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Feb 16 09:54:13 2018 -0500 Merge branch 'maint-0.3.1' into maint-0.3.2 changes/bug24952 | 5 + changes/bug25223 | 4 + changes/ticket24902 | 13 + changes/ticket25122 | 4 + changes/ticket25202 | 4 + doc/tor.1.txt | 95 ++++++ src/common/address.c | 27 +- src/common/address.h | 2 + src/common/address_set.c | 129 +++++++ src/common/address_set.h | 35 ++ src/common/include.am | 2 + src/common/log.c | 2 +- src/common/torlog.h | 4 +- src/or/channel.c | 9 +- src/or/channel.h | 3 +- src/or/channeltls.c | 2 +- src/or/command.c | 13 + src/or/config.c | 25 ++ src/or/connection.c | 16 + src/or/dos.c | 794 ++++++++++++++++++++++++++++++++++++++++++++ src/or/dos.h | 140 ++++++++ src/or/geoip.c | 205 ++++++++++-- src/or/geoip.h | 29 ++ src/or/include.am | 2 + src/or/main.c | 2 + src/or/networkstatus.c | 2 + src/or/nodelist.c | 77 +++++ src/or/nodelist.h | 3 + src/or/or.h | 33 ++ src/or/relay.c | 14 +- src/or/rendmid.c | 12 + src/or/status.c | 2 + src/test/include.am | 2 + src/test/test.c | 20 ++ src/test/test.h | 2 + src/test/test_address_set.c | 174 ++++++++++ src/test/test_dos.c | 497 +++++++++++++++++++++++++++ 37 files changed, 2361 insertions(+), 43 deletions(-) diff --cc src/common/address.c index dbe129be5,e6b437e9d..c683e90aa --- a/src/common/address.c +++ b/src/common/address.c @@@ -1193,11 -1194,11 +1196,11 @@@ tor_addr_hash(const tor_addr_t *addr case AF_INET: return siphash24g(&addr->addr.in_addr.s_addr, 4); case AF_UNSPEC: - return 0x4e4d5342; + return siphash24g(unspec_hash_input, sizeof(unspec_hash_input)); case AF_INET6: return siphash24g(&addr->addr.in6_addr.s6_addr, 16); - default: /* LCOV_EXCL_START */ + default: tor_fragile_assert(); return 0; /* LCOV_EXCL_STOP */ diff --cc src/common/include.am index cd5eea340,d12895b10..715ec0264 --- a/src/common/include.am +++ b/src/common/include.am @@@ -80,8 -80,8 +80,9 @@@ src_common_libor_ctime_testing_a_CFLAG LIBOR_A_SRC = \ src/common/address.c \ + src/common/address_set.c \ src/common/backtrace.c \ + src/common/buffers.c \ src/common/compat.c \ src/common/compat_threads.c \ src/common/compat_time.c \ @@@ -148,9 -147,8 +149,10 @@@ src_common_libor_event_testing_a_CFLAG COMMONHEADERS = \ src/common/address.h \ + src/common/address_set.h \ src/common/backtrace.h \ + src/common/buffers.h \ + src/common/buffers_tls.h \ src/common/aes.h \ src/common/ciphers.inc \ src/common/compat.h \ diff --cc src/or/connection.c index d2cf4fb41,fc0646b88..ed8de05d7 --- a/src/or/connection.c +++ b/src/or/connection.c @@@ -704,7 -696,14 +705,14 @@@ connection_free,(connection_t *conn) connection_ap_warn_and_unmark_if_pending_circ(TO_ENTRY_CONN(conn), "connection_free"); } -#endif +#endif /* 1 */ + + /* Notify the circuit creation DoS mitigation subsystem that an OR client + * connection has been closed. And only do that if we track it. */ + if (conn->type == CONN_TYPE_OR) { + dos_close_client_conn(TO_OR_CONN(conn)); + } + connection_unregister_events(conn); connection_free_(conn); } diff --cc src/or/geoip.h index acf61b97a,773525ccf..753bdbf82 --- a/src/or/geoip.h +++ b/src/or/geoip.h @@@ -19,7 -20,30 +20,30 @@@ STATIC int geoip_parse_entry(const cha STATIC int geoip_get_country_by_ipv4(uint32_t ipaddr); STATIC int geoip_get_country_by_ipv6(const struct in6_addr *addr); STATIC void clear_geoip_db(void); -#endif +#endif /* defined(GEOIP_PRIVATE) */ + + /** Entry in a map from IP address to the last time we've seen an incoming + * connection from that IP address. Used by bridges only to track which + * countries have them blocked, or the DoS mitigation subsystem if enabled. */ + typedef struct clientmap_entry_t { + HT_ENTRY(clientmap_entry_t) node; + tor_addr_t addr; + /* Name of pluggable transport used by this client. NULL if no + pluggable transport was used. */ + char *transport_name; + + /** Time when we last saw this IP address, in MINUTES since the epoch. + * + * (This will run out of space around 4011 CE. If Tor is still in use around + * 4000 CE, please remember to add more bits to last_seen_in_minutes.) */ + unsigned int last_seen_in_minutes:30; + unsigned int action:2; + + /* This object is used to keep some statistics per client address for the + * DoS mitigation subsystem. */ + dos_client_stats_t dos_stats; + } clientmap_entry_t; + int should_record_bridge_info(const or_options_t *options); int geoip_load_file(sa_family_t family, const char *filename); MOCK_DECL(int, geoip_get_country_by_addr, (const tor_addr_t *addr)); diff --cc src/or/include.am index 7216aba9a,5d5ff5c41..abf62c2e8 --- a/src/or/include.am +++ b/src/or/include.am @@@ -47,8 -48,13 +47,9 @@@ LIBTOR_A_SOURCES = src/or/dirvote.c \ src/or/dns.c \ src/or/dnsserv.c \ + src/or/dos.c \ src/or/fp_pair.c \ src/or/geoip.c \ - src/or/hs_intropoint.c \ - src/or/hs_circuitmap.c \ - src/or/hs_ntor.c \ - src/or/hs_service.c \ src/or/entrynodes.c \ src/or/ext_orport.c \ src/or/hibernate.c \ diff --cc src/or/main.c index c340e4128,197dfd430..036ef1efd --- a/src/or/main.c +++ b/src/or/main.c @@@ -3268,7 -3242,7 +3269,8 @@@ tor_free_all(int postfork protover_free_all(); bridges_free_all(); consdiffmgr_free_all(); + hs_free_all(); + dos_free_all(); if (!postfork) { config_free_all(); or_state_free_all(); diff --cc src/or/networkstatus.c index 9d9a2b8ad,e59069e84..dd82f6681 --- a/src/or/networkstatus.c +++ b/src/or/networkstatus.c @@@ -1564,22 -1604,15 +1565,23 @@@ notify_control_networkstatus_changed(co smartlist_free(changed); } -/* Called when the consensus has changed from old_c to new_c. */ +/* Called before the consensus changes from old_c to new_c. */ static void -notify_networkstatus_changed(const networkstatus_t *old_c, - const networkstatus_t *new_c) +notify_before_networkstatus_changes(const networkstatus_t *old_c, + const networkstatus_t *new_c) { notify_control_networkstatus_changed(old_c, new_c); + dos_consensus_has_changed(new_c); } +/* Called after a new consensus has been put in the global state. It is safe + * to use the consensus getters in this function. */ +static void +notify_after_networkstatus_changes(void) +{ + scheduler_notify_networkstatus_changed(); +} + /** Copy all the ancillary information (like router download status and so on) * from old_c to new_c. */ static void diff --cc src/or/nodelist.c index f2e979be8,c754ebdb6..9a477ecf4 --- a/src/or/nodelist.c +++ b/src/or/nodelist.c @@@ -38,10 -38,9 +38,11 @@@ * used for authorities and fallback directories.) */ +#define NODELIST_PRIVATE + #include "or.h" #include "address.h" + #include "address_set.h" #include "config.h" #include "control.h" #include "dirserv.h" @@@ -95,14 -92,9 +97,16 @@@ typedef struct nodelist_t smartlist_t *nodes; /* Hash table to map from node ID digest to node. */ HT_HEAD(nodelist_map, node_t) nodes_by_id; - + /* Hash table to map from node Ed25519 ID to node. + * + * Whenever a node's routerinfo or microdescriptor is about to change, + * you should remove it from this map with node_remove_from_ed25519_map(). + * Whenever a node's routerinfo or microdescriptor has just chaned, + * you should add it to this map with node_add_to_ed25519_map(). + */ + HT_HEAD(nodelist_ed_map, node_t) nodes_by_ed_id; + /* Set of addresses that belong to nodes we believe in. */ + address_set_t *node_addrs; } nodelist_t; static inline unsigned int @@@ -442,14 -264,8 +490,16 @@@ nodelist_set_routerinfo(routerinfo_t *r dirserv_set_node_flags_from_authoritative_status(node, status); } + /* Setting the HSDir index requires the ed25519 identity key which can + * only be found either in the ri or md. This is why this is called here. + * Only nodes supporting HSDir=2 protocol version needs this index. */ + if (node->rs && node->rs->supports_v3_hsdir) { + node_set_hsdir_index(node, + networkstatus_get_latest_consensus()); + } + + node_add_to_address_set(node); + return node; } @@@ -476,21 -292,14 +526,23 @@@ nodelist_add_microdesc(microdesc_t *md return NULL; node = node_get_mutable_by_id(rs->identity_digest); if (node) { + node_remove_from_ed25519_map(node); if (node->md) node->md->held_by_nodes--; + node->md = md; md->held_by_nodes++; + /* Setting the HSDir index requires the ed25519 identity key which can + * only be found either in the ri or md. This is why this is called here. + * Only nodes supporting HSDir=2 protocol version needs this index. */ + if (rs->supports_v3_hsdir) { + node_set_hsdir_index(node, ns); + } + node_add_to_ed25519_map(node); } + node_add_to_address_set(node); + return node; } diff --cc src/or/nodelist.h index 754990ac8,9cd66f60a..8a0c79f86 --- a/src/or/nodelist.h +++ b/src/or/nodelist.h @@@ -142,16 -132,7 +143,18 @@@ void router_dir_info_changed(void) const char *get_dir_info_status_string(void); int count_loading_descriptors_progress(void); +#ifdef NODELIST_PRIVATE + +#ifdef TOR_UNIT_TESTS + +STATIC void +node_set_hsdir_index(node_t *node, const networkstatus_t *ns); + +#endif /* defined(TOR_UNIT_TESTS) */ + +#endif /* defined(NODELIST_PRIVATE) */ + + MOCK_DECL(int, get_estimated_address_per_node, (void)); + -#endif +#endif /* !defined(TOR_NODELIST_H) */ diff --cc src/or/or.h index 03e20b80d,9e7833386..5128fd219 --- a/src/or/or.h +++ b/src/or/or.h @@@ -4624,28 -4583,36 +4628,57 @@@ typedef struct * use the default. */ int MaxConsensusAgeForDiffs; + /** Bool (default: 0). Tells Tor to never try to exec another program. + */ + int NoExec; + + /** Have the KIST scheduler run every X milliseconds. If less than zero, do + * not use the KIST scheduler but use the old vanilla scheduler instead. If + * zero, do what the consensus says and fall back to using KIST as if this is + * set to "10 msec" if the consensus doesn't say anything. */ + int KISTSchedRunInterval; + + /** A multiplier for the KIST per-socket limit calculation. */ + double KISTSockBufSizeFactor; + + /** The list of scheduler type string ordered by priority that is first one + * has to be tried first. Default: KIST,KISTLite,Vanilla */ + smartlist_t *Schedulers; + /* An ordered list of scheduler_types mapped from Schedulers. */ + smartlist_t *SchedulerTypes_; ++ + /** Autobool: Is the circuit creation DoS mitigation subsystem enabled? */ + int DoSCircuitCreationEnabled; + /** Minimum concurrent connection needed from one single address before any + * defense is used. */ + int DoSCircuitCreationMinConnections; + /** Circuit rate used to refill the token bucket. */ + int DoSCircuitCreationRate; + /** Maximum allowed burst of circuits. Reaching that value, the address is + * detected as malicious and a defense might be used. */ + int DoSCircuitCreationBurst; + /** When an address is marked as malicous, what defense should be used + * against it. See the dos_cc_defense_type_t enum. */ + int DoSCircuitCreationDefenseType; + /** For how much time (in seconds) the defense is applicable for a malicious + * address. A random time delta is added to the defense time of an address + * which will be between 1 second and half of this value. */ + int DoSCircuitCreationDefenseTimePeriod; + + /** Autobool: Is the DoS connection mitigation subsystem enabled? */ + int DoSConnectionEnabled; + /** Maximum concurrent connection allowed per address. */ + int DoSConnectionMaxConcurrentCount; + /** When an address is reaches the maximum count, what defense should be + * used against it. See the dos_conn_defense_type_t enum. */ + int DoSConnectionDefenseType; + + /** Autobool: Do we refuse single hop client rendezvous? */ + int DoSRefuseSingleHopClientRendezvous; } or_options_t; +#define LOG_PROTOCOL_WARN (get_protocol_warning_severity_level()) + /** Persistent state for an onion router, as saved to disk. */ typedef struct { uint32_t magic_;

1 0

[tor/release-0.3.2] man: Document default values if not in the consensus for DoS mitigation
by nickm＠torproject.org 16 Feb '18

16 Feb '18

commit 9cf8d669fa416c151f60cb795555b6ef2ab53ecf Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Feb 13 10:53:47 2018 -0500 man: Document default values if not in the consensus for DoS mitigation Fixes #25236 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- doc/tor.1.txt | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 58997cdf3..a7ee7d11c 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2454,7 +2454,7 @@ Denial of Service mitigation subsystem. address is positively identified, tor will activate defenses against the address. See the DoSCircuitCreationDefenseType option for more details. This is a client to relay detection only. "auto" means use the consensus - parameter. + parameter. If not defined in the consensus, the value is 0. (Default: auto) [[DoSCircuitCreationMinConnections]] **DoSCircuitCreationMinConnections** __NUM__:: @@ -2463,19 +2463,22 @@ Denial of Service mitigation subsystem. flagged as executing a circuit creation DoS. In other words, once a client address reaches the circuit rate and has a minimum of NUM concurrent connections, a detection is positive. "0" means use the consensus - parameter. + parameter. If not defined in the consensus, the value is 3. (Default: 0) [[DoSCircuitCreationRate]] **DoSCircuitCreationRate** __NUM__:: The allowed circuit creation rate per second applied per client IP - address. If this option is 0, it obeys a consensus parameter. (Default: 0) + address. If this option is 0, it obeys a consensus parameter. If not + defined in the consensus, the value is 3. + (Default: 0) [[DoSCircuitCreationBurst]] **DoSCircuitCreationBurst** __NUM__:: The allowed circuit creation burst per client IP address. If the circuit rate and the burst are reached, a client is marked as executing a circuit - creation DoS. "0" means use the consensus parameter. + creation DoS. "0" means use the consensus parameter. If not defined in the + consensus, the value is 90. (Default: 0) [[DoSCircuitCreationDefenseType]] **DoSCircuitCreationDefenseType** __NUM__:: @@ -2486,28 +2489,31 @@ Denial of Service mitigation subsystem. 1: No defense. 2: Refuse circuit creation for the DoSCircuitCreationDefenseTimePeriod period of time. + - "0" means use the consensus parameter. + "0" means use the consensus parameter. If not defined in the consensus, + the value is 2. (Default: 0) -[[DoSCircuitCreationDefenseTimePeriod]] **DoSCircuitCreationDefenseTimePeriod** __NUM__:: +[[DoSCircuitCreationDefenseTimePeriod]] **DoSCircuitCreationDefenseTimePeriod** __N__ **seconds**|**minutes**|**hours**:: - The base time period that the DoS defense is activated for. The actual - value is selected randomly for each activation from NUM+1 to 3/2 * NUM. - "0" means use the consensus parameter. - (Default: 0) + The base time period in seconds that the DoS defense is activated for. The + actual value is selected randomly for each activation from N+1 to 3/2 * N. + "0" means use the consensus parameter. If not defined in the consensus, + the value is 3600 seconds (1 hour). (Default: 0) [[DoSConnectionEnabled]] **DoSConnectionEnabled** **0**|**1**|**auto**:: Enable the connection DoS mitigation. For client address only, this allows tor to mitigate against large number of concurrent connections made by a - single IP address. "auto" means use the consensus parameter. + single IP address. "auto" means use the consensus parameter. If not + defined in the consensus, the value is 0. (Default: auto) [[DoSConnectionMaxConcurrentCount]] **DoSConnectionMaxConcurrentCount** __NUM__:: The maximum threshold of concurrent connection from a client IP address. Above this limit, a defense selected by DoSConnectionDefenseType is - applied. "0" means use the consensus parameter. + applied. "0" means use the consensus parameter. If not defined in the + consensus, the value is 100. (Default: 0) [[DoSConnectionDefenseType]] **DoSConnectionDefenseType** __NUM__:: @@ -2518,7 +2524,8 @@ Denial of Service mitigation subsystem. 1: No defense. 2: Immediately close new connections. + - "0" means use the consensus parameter. + "0" means use the consensus parameter. If not defined in the consensus, + the value is 2. (Default: 0) [[DoSRefuseSingleHopClientRendezvous]] **DoSRefuseSingleHopClientRendezvous** **0**|**1**|**auto**:: @@ -2526,7 +2533,7 @@ Denial of Service mitigation subsystem. Refuse establishment of rendezvous points for single hop clients. In other words, if a client directly connects to the relay and sends an ESTABLISH_RENDEZVOUS cell, it is silently dropped. "auto" means use the - consensus parameter. + consensus parameter. If not defined in the consensus, the value is 0. (Default: auto) TESTING NETWORK OPTIONS

1 0

[tor/release-0.3.2] Merge branch 'maint-0.3.1' into maint-0.3.2
by nickm＠torproject.org 16 Feb '18

16 Feb '18

commit bd71e0a0c8ccf684c40201f08c456596eac60887 Merge: c67adddac 2bcd264a2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Feb 16 09:54:13 2018 -0500 Merge branch 'maint-0.3.1' into maint-0.3.2 changes/bug24952 | 5 + changes/bug25223 | 4 + changes/ticket24902 | 13 + changes/ticket25122 | 4 + changes/ticket25202 | 4 + doc/tor.1.txt | 95 ++++++ src/common/address.c | 27 +- src/common/address.h | 2 + src/common/address_set.c | 129 +++++++ src/common/address_set.h | 35 ++ src/common/include.am | 2 + src/common/log.c | 2 +- src/common/torlog.h | 4 +- src/or/channel.c | 9 +- src/or/channel.h | 3 +- src/or/channeltls.c | 2 +- src/or/command.c | 13 + src/or/config.c | 25 ++ src/or/connection.c | 16 + src/or/dos.c | 794 ++++++++++++++++++++++++++++++++++++++++++++ src/or/dos.h | 140 ++++++++ src/or/geoip.c | 205 ++++++++++-- src/or/geoip.h | 29 ++ src/or/include.am | 2 + src/or/main.c | 2 + src/or/networkstatus.c | 2 + src/or/nodelist.c | 77 +++++ src/or/nodelist.h | 3 + src/or/or.h | 33 ++ src/or/relay.c | 14 +- src/or/rendmid.c | 12 + src/or/status.c | 2 + src/test/include.am | 2 + src/test/test.c | 20 ++ src/test/test.h | 2 + src/test/test_address_set.c | 174 ++++++++++ src/test/test_dos.c | 497 +++++++++++++++++++++++++++ 37 files changed, 2361 insertions(+), 43 deletions(-) diff --cc src/common/address.c index dbe129be5,e6b437e9d..c683e90aa --- a/src/common/address.c +++ b/src/common/address.c @@@ -1193,11 -1194,11 +1196,11 @@@ tor_addr_hash(const tor_addr_t *addr case AF_INET: return siphash24g(&addr->addr.in_addr.s_addr, 4); case AF_UNSPEC: - return 0x4e4d5342; + return siphash24g(unspec_hash_input, sizeof(unspec_hash_input)); case AF_INET6: return siphash24g(&addr->addr.in6_addr.s6_addr, 16); - default: /* LCOV_EXCL_START */ + default: tor_fragile_assert(); return 0; /* LCOV_EXCL_STOP */ diff --cc src/common/include.am index cd5eea340,d12895b10..715ec0264 --- a/src/common/include.am +++ b/src/common/include.am @@@ -80,8 -80,8 +80,9 @@@ src_common_libor_ctime_testing_a_CFLAG LIBOR_A_SRC = \ src/common/address.c \ + src/common/address_set.c \ src/common/backtrace.c \ + src/common/buffers.c \ src/common/compat.c \ src/common/compat_threads.c \ src/common/compat_time.c \ @@@ -148,9 -147,8 +149,10 @@@ src_common_libor_event_testing_a_CFLAG COMMONHEADERS = \ src/common/address.h \ + src/common/address_set.h \ src/common/backtrace.h \ + src/common/buffers.h \ + src/common/buffers_tls.h \ src/common/aes.h \ src/common/ciphers.inc \ src/common/compat.h \ diff --cc src/or/connection.c index d2cf4fb41,fc0646b88..ed8de05d7 --- a/src/or/connection.c +++ b/src/or/connection.c @@@ -704,7 -696,14 +705,14 @@@ connection_free,(connection_t *conn) connection_ap_warn_and_unmark_if_pending_circ(TO_ENTRY_CONN(conn), "connection_free"); } -#endif +#endif /* 1 */ + + /* Notify the circuit creation DoS mitigation subsystem that an OR client + * connection has been closed. And only do that if we track it. */ + if (conn->type == CONN_TYPE_OR) { + dos_close_client_conn(TO_OR_CONN(conn)); + } + connection_unregister_events(conn); connection_free_(conn); } diff --cc src/or/geoip.h index acf61b97a,773525ccf..753bdbf82 --- a/src/or/geoip.h +++ b/src/or/geoip.h @@@ -19,7 -20,30 +20,30 @@@ STATIC int geoip_parse_entry(const cha STATIC int geoip_get_country_by_ipv4(uint32_t ipaddr); STATIC int geoip_get_country_by_ipv6(const struct in6_addr *addr); STATIC void clear_geoip_db(void); -#endif +#endif /* defined(GEOIP_PRIVATE) */ + + /** Entry in a map from IP address to the last time we've seen an incoming + * connection from that IP address. Used by bridges only to track which + * countries have them blocked, or the DoS mitigation subsystem if enabled. */ + typedef struct clientmap_entry_t { + HT_ENTRY(clientmap_entry_t) node; + tor_addr_t addr; + /* Name of pluggable transport used by this client. NULL if no + pluggable transport was used. */ + char *transport_name; + + /** Time when we last saw this IP address, in MINUTES since the epoch. + * + * (This will run out of space around 4011 CE. If Tor is still in use around + * 4000 CE, please remember to add more bits to last_seen_in_minutes.) */ + unsigned int last_seen_in_minutes:30; + unsigned int action:2; + + /* This object is used to keep some statistics per client address for the + * DoS mitigation subsystem. */ + dos_client_stats_t dos_stats; + } clientmap_entry_t; + int should_record_bridge_info(const or_options_t *options); int geoip_load_file(sa_family_t family, const char *filename); MOCK_DECL(int, geoip_get_country_by_addr, (const tor_addr_t *addr)); diff --cc src/or/include.am index 7216aba9a,5d5ff5c41..abf62c2e8 --- a/src/or/include.am +++ b/src/or/include.am @@@ -47,8 -48,13 +47,9 @@@ LIBTOR_A_SOURCES = src/or/dirvote.c \ src/or/dns.c \ src/or/dnsserv.c \ + src/or/dos.c \ src/or/fp_pair.c \ src/or/geoip.c \ - src/or/hs_intropoint.c \ - src/or/hs_circuitmap.c \ - src/or/hs_ntor.c \ - src/or/hs_service.c \ src/or/entrynodes.c \ src/or/ext_orport.c \ src/or/hibernate.c \ diff --cc src/or/main.c index c340e4128,197dfd430..036ef1efd --- a/src/or/main.c +++ b/src/or/main.c @@@ -3268,7 -3242,7 +3269,8 @@@ tor_free_all(int postfork protover_free_all(); bridges_free_all(); consdiffmgr_free_all(); + hs_free_all(); + dos_free_all(); if (!postfork) { config_free_all(); or_state_free_all(); diff --cc src/or/networkstatus.c index 9d9a2b8ad,e59069e84..dd82f6681 --- a/src/or/networkstatus.c +++ b/src/or/networkstatus.c @@@ -1564,22 -1604,15 +1565,23 @@@ notify_control_networkstatus_changed(co smartlist_free(changed); } -/* Called when the consensus has changed from old_c to new_c. */ +/* Called before the consensus changes from old_c to new_c. */ static void -notify_networkstatus_changed(const networkstatus_t *old_c, - const networkstatus_t *new_c) +notify_before_networkstatus_changes(const networkstatus_t *old_c, + const networkstatus_t *new_c) { notify_control_networkstatus_changed(old_c, new_c); + dos_consensus_has_changed(new_c); } +/* Called after a new consensus has been put in the global state. It is safe + * to use the consensus getters in this function. */ +static void +notify_after_networkstatus_changes(void) +{ + scheduler_notify_networkstatus_changed(); +} + /** Copy all the ancillary information (like router download status and so on) * from old_c to new_c. */ static void diff --cc src/or/nodelist.c index f2e979be8,c754ebdb6..9a477ecf4 --- a/src/or/nodelist.c +++ b/src/or/nodelist.c @@@ -38,10 -38,9 +38,11 @@@ * used for authorities and fallback directories.) */ +#define NODELIST_PRIVATE + #include "or.h" #include "address.h" + #include "address_set.h" #include "config.h" #include "control.h" #include "dirserv.h" @@@ -95,14 -92,9 +97,16 @@@ typedef struct nodelist_t smartlist_t *nodes; /* Hash table to map from node ID digest to node. */ HT_HEAD(nodelist_map, node_t) nodes_by_id; - + /* Hash table to map from node Ed25519 ID to node. + * + * Whenever a node's routerinfo or microdescriptor is about to change, + * you should remove it from this map with node_remove_from_ed25519_map(). + * Whenever a node's routerinfo or microdescriptor has just chaned, + * you should add it to this map with node_add_to_ed25519_map(). + */ + HT_HEAD(nodelist_ed_map, node_t) nodes_by_ed_id; + /* Set of addresses that belong to nodes we believe in. */ + address_set_t *node_addrs; } nodelist_t; static inline unsigned int @@@ -442,14 -264,8 +490,16 @@@ nodelist_set_routerinfo(routerinfo_t *r dirserv_set_node_flags_from_authoritative_status(node, status); } + /* Setting the HSDir index requires the ed25519 identity key which can + * only be found either in the ri or md. This is why this is called here. + * Only nodes supporting HSDir=2 protocol version needs this index. */ + if (node->rs && node->rs->supports_v3_hsdir) { + node_set_hsdir_index(node, + networkstatus_get_latest_consensus()); + } + + node_add_to_address_set(node); + return node; } @@@ -476,21 -292,14 +526,23 @@@ nodelist_add_microdesc(microdesc_t *md return NULL; node = node_get_mutable_by_id(rs->identity_digest); if (node) { + node_remove_from_ed25519_map(node); if (node->md) node->md->held_by_nodes--; + node->md = md; md->held_by_nodes++; + /* Setting the HSDir index requires the ed25519 identity key which can + * only be found either in the ri or md. This is why this is called here. + * Only nodes supporting HSDir=2 protocol version needs this index. */ + if (rs->supports_v3_hsdir) { + node_set_hsdir_index(node, ns); + } + node_add_to_ed25519_map(node); } + node_add_to_address_set(node); + return node; } diff --cc src/or/nodelist.h index 754990ac8,9cd66f60a..8a0c79f86 --- a/src/or/nodelist.h +++ b/src/or/nodelist.h @@@ -142,16 -132,7 +143,18 @@@ void router_dir_info_changed(void) const char *get_dir_info_status_string(void); int count_loading_descriptors_progress(void); +#ifdef NODELIST_PRIVATE + +#ifdef TOR_UNIT_TESTS + +STATIC void +node_set_hsdir_index(node_t *node, const networkstatus_t *ns); + +#endif /* defined(TOR_UNIT_TESTS) */ + +#endif /* defined(NODELIST_PRIVATE) */ + + MOCK_DECL(int, get_estimated_address_per_node, (void)); + -#endif +#endif /* !defined(TOR_NODELIST_H) */ diff --cc src/or/or.h index 03e20b80d,9e7833386..5128fd219 --- a/src/or/or.h +++ b/src/or/or.h @@@ -4624,28 -4583,36 +4628,57 @@@ typedef struct * use the default. */ int MaxConsensusAgeForDiffs; + /** Bool (default: 0). Tells Tor to never try to exec another program. + */ + int NoExec; + + /** Have the KIST scheduler run every X milliseconds. If less than zero, do + * not use the KIST scheduler but use the old vanilla scheduler instead. If + * zero, do what the consensus says and fall back to using KIST as if this is + * set to "10 msec" if the consensus doesn't say anything. */ + int KISTSchedRunInterval; + + /** A multiplier for the KIST per-socket limit calculation. */ + double KISTSockBufSizeFactor; + + /** The list of scheduler type string ordered by priority that is first one + * has to be tried first. Default: KIST,KISTLite,Vanilla */ + smartlist_t *Schedulers; + /* An ordered list of scheduler_types mapped from Schedulers. */ + smartlist_t *SchedulerTypes_; ++ + /** Autobool: Is the circuit creation DoS mitigation subsystem enabled? */ + int DoSCircuitCreationEnabled; + /** Minimum concurrent connection needed from one single address before any + * defense is used. */ + int DoSCircuitCreationMinConnections; + /** Circuit rate used to refill the token bucket. */ + int DoSCircuitCreationRate; + /** Maximum allowed burst of circuits. Reaching that value, the address is + * detected as malicious and a defense might be used. */ + int DoSCircuitCreationBurst; + /** When an address is marked as malicous, what defense should be used + * against it. See the dos_cc_defense_type_t enum. */ + int DoSCircuitCreationDefenseType; + /** For how much time (in seconds) the defense is applicable for a malicious + * address. A random time delta is added to the defense time of an address + * which will be between 1 second and half of this value. */ + int DoSCircuitCreationDefenseTimePeriod; + + /** Autobool: Is the DoS connection mitigation subsystem enabled? */ + int DoSConnectionEnabled; + /** Maximum concurrent connection allowed per address. */ + int DoSConnectionMaxConcurrentCount; + /** When an address is reaches the maximum count, what defense should be + * used against it. See the dos_conn_defense_type_t enum. */ + int DoSConnectionDefenseType; + + /** Autobool: Do we refuse single hop client rendezvous? */ + int DoSRefuseSingleHopClientRendezvous; } or_options_t; +#define LOG_PROTOCOL_WARN (get_protocol_warning_severity_level()) + /** Persistent state for an onion router, as saved to disk. */ typedef struct { uint32_t magic_;

1 0

[tor/release-0.3.2] dos: Add extra safety asserts in cc_stats_refill_bucket()
by nickm＠torproject.org 16 Feb '18

16 Feb '18

commit 305e39d0f8bcc39d45c2877495046bd927347106 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Feb 13 10:41:21 2018 -0500 dos: Add extra safety asserts in cc_stats_refill_bucket() Never allow the function to set a bucket value above the allowed circuit burst. Closes #25202 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket25202 | 4 ++++ src/or/dos.c | 10 ++++++++++ 2 files changed, 14 insertions(+) diff --git a/changes/ticket25202 b/changes/ticket25202 new file mode 100644 index 000000000..5edef44f0 --- /dev/null +++ b/changes/ticket25202 @@ -0,0 +1,4 @@ + o Minor bugfixes (DoS mitigation): + - Add extra safety checks when refilling the circuit creation bucket to + ensure we never set a value that is above the allowed burst. Fixes + ticket 25202. diff --git a/src/or/dos.c b/src/or/dos.c index 9e8a7a9ab..e7f3241ef 100644 --- a/src/or/dos.c +++ b/src/or/dos.c @@ -309,6 +309,16 @@ cc_stats_refill_bucket(cc_client_stats_t *stats, const tor_addr_t *addr) new_circuit_bucket_count = MIN(stats->circuit_bucket + (uint32_t)num_token, dos_cc_circuit_burst); } + + /* This function is not allowed to make the bucket count larger than the + * burst value */ + tor_assert_nonfatal(new_circuit_bucket_count <= dos_cc_circuit_burst); + /* This function is not allowed to make the bucket count smaller, unless it + * is decreasing it to a newly configured, lower burst value. We allow the + * bucket to stay the same size, in case the circuit rate is zero. */ + tor_assert_nonfatal(new_circuit_bucket_count >= stats->circuit_bucket || + new_circuit_bucket_count == dos_cc_circuit_burst); + log_debug(LD_DOS, "DoS address %s has its circuit bucket value: %" PRIu32 ". Filling it to %" PRIu32 ". Circuit rate is %" PRIu64 ". Elapsed time is %" PRIi64,

1 0

[tor/release-0.3.2] Merge remote-tracking branch 'dgoulet/ticket24902_029_05' into maint-0.2.9
by nickm＠torproject.org 16 Feb '18

16 Feb '18

1 0

[tor/release-0.3.2] Merge remote-tracking branch 'dgoulet/bug25223_029_01' into ticket24902_029_05
by nickm＠torproject.org 16 Feb '18

16 Feb '18

commit b60ffc5ce0fc9dfd4c2fbb238e32143c64fadbda Merge: 305e39d0f 4fe4f8179 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Feb 13 13:11:10 2018 -0500 Merge remote-tracking branch 'dgoulet/bug25223_029_01' into ticket24902_029_05 changes/bug25223 | 3 +++ src/or/dos.c | 8 ++++++++ 2 files changed, 11 insertions(+)

1 0

[tor/release-0.3.3] Merge branch 'maint-0.3.2' into maint-0.3.3
by nickm＠torproject.org 16 Feb '18

16 Feb '18

commit 6384d314fb47a088299a14b52e5f60b6e79697b4 Merge: 9f1899fdf bd71e0a0c Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Feb 16 09:55:41 2018 -0500 Merge branch 'maint-0.3.2' into maint-0.3.3 "ours" merge to avoid taking 24902 a second time and having to reconcile all the merge conflicts.

1 0

[tor/release-0.2.9] Merge remote-tracking branch 'dgoulet/ticket24902_029_05' into maint-0.2.9
by nickm＠torproject.org 16 Feb '18

16 Feb '18

1 0

[tor/release-0.2.9] Merge remote-tracking branch 'dgoulet/bug25223_029_01' into ticket24902_029_05
by nickm＠torproject.org 16 Feb '18

16 Feb '18

commit b60ffc5ce0fc9dfd4c2fbb238e32143c64fadbda Merge: 305e39d0f 4fe4f8179 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Feb 13 13:11:10 2018 -0500 Merge remote-tracking branch 'dgoulet/bug25223_029_01' into ticket24902_029_05 changes/bug25223 | 3 +++ src/or/dos.c | 8 ++++++++ 2 files changed, 11 insertions(+)

1 0