September 2019 - tor-commits - lists.torproject.org

[tor/master] hs-v3: Move to hs_dos.c INTRO2 defenses initialization
by nickm＠torproject.org 09 Sep '19

09 Sep '19

commit 82639a8c7bf59bb6ae73218cd78cee07b6586d96 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Aug 20 08:35:21 2019 -0400 hs-v3: Move to hs_dos.c INTRO2 defenses initialization A bit cleaner especially that the next commit(s) will make the consensus param interface private to hs_dos.c so we expose as little as we can outside of the subsystem. Part of #30924 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/hs/hs_dos.c | 15 +++++++++++++++ src/feature/hs/hs_dos.h | 1 + src/feature/hs/hs_intropoint.c | 11 +++-------- src/feature/rend/rendmid.c | 3 +-- 4 files changed, 20 insertions(+), 10 deletions(-) diff --git a/src/feature/hs/hs_dos.c b/src/feature/hs/hs_dos.c index d83c8ee10..0eb306977 100644 --- a/src/feature/hs/hs_dos.c +++ b/src/feature/hs/hs_dos.c @@ -135,6 +135,21 @@ hs_dos_get_intro2_enabled_param(void) return (unsigned int) param_introduce_defense_enabled; } +/* Initialize the INTRODUCE2 token bucket for the DoS defenses using the + * consensus/default values. We might get a cell extension that changes those + * later but if we don't, the default or consensus parameters are used. */ +void +hs_dos_setup_default_intro2_defenses(or_circuit_t *circ) +{ + tor_assert(circ); + + circ->introduce2_dos_defense_enabled = get_param_intro_dos_enabled(NULL); + token_bucket_ctr_init(&circ->introduce2_bucket, + get_param_rate_per_sec(NULL), + get_param_burst_per_sec(NULL), + (uint32_t) approx_time()); +} + /* Called when the consensus has changed. We might have new consensus * parameters to look at. */ void diff --git a/src/feature/hs/hs_dos.h b/src/feature/hs/hs_dos.h index ee7b697c7..1d2dd67d0 100644 --- a/src/feature/hs/hs_dos.h +++ b/src/feature/hs/hs_dos.h @@ -22,6 +22,7 @@ void hs_dos_consensus_has_changed(const networkstatus_t *ns); /* Introduction Point. */ bool hs_dos_can_send_intro2(or_circuit_t *s_intro_circ); +void hs_dos_setup_default_intro2_defenses(or_circuit_t *circ); unsigned int hs_dos_get_intro2_enabled_param(void); uint32_t hs_dos_get_intro2_rate_param(void); diff --git a/src/feature/hs/hs_intropoint.c b/src/feature/hs/hs_intropoint.c index bafd3d1f4..fc7d96194 100644 --- a/src/feature/hs/hs_intropoint.c +++ b/src/feature/hs/hs_intropoint.c @@ -298,14 +298,9 @@ handle_verified_establish_intro_cell(or_circuit_t *circ, get_auth_key_from_cell(&auth_key, RELAY_COMMAND_ESTABLISH_INTRO, parsed_cell); - /* Initialize the INTRODUCE2 token bucket for the DoS defenses using the - * consensus/default values. We might get a cell extension that changes - * those but if we don't, the default or consensus parameters are used. */ - circ->introduce2_dos_defense_enabled = hs_dos_get_intro2_enabled_param(); - token_bucket_ctr_init(&circ->introduce2_bucket, - hs_dos_get_intro2_rate_param(), - hs_dos_get_intro2_burst_param(), - (uint32_t) approx_time()); + /* Setup INTRODUCE2 defenses on the circuit. Must be done before parsing the + * cell extension that can possibly change the defenses' values. */ + hs_dos_setup_default_intro2_defenses(circ); /* Handle cell extension if any. */ handle_establish_intro_cell_extensions(parsed_cell, circ); diff --git a/src/feature/rend/rendmid.c b/src/feature/rend/rendmid.c index ef2a44c40..be3d66fc4 100644 --- a/src/feature/rend/rendmid.c +++ b/src/feature/rend/rendmid.c @@ -117,8 +117,7 @@ rend_mid_establish_intro_legacy(or_circuit_t *circ, const uint8_t *request, /* Now, set up this circuit. */ circuit_change_purpose(TO_CIRCUIT(circ), CIRCUIT_PURPOSE_INTRO_POINT); hs_circuitmap_register_intro_circ_v2_relay_side(circ, (uint8_t *)pk_digest); - token_bucket_ctr_init(&circ->introduce2_bucket, hs_dos_get_intro2_rate(), - hs_dos_get_intro2_burst(), (uint32_t) approx_time()); + hs_dos_setup_default_intro2_defenses(circ); log_info(LD_REND, "Established introduction point on circuit %u for service %s",

1 0

[tor/master] hs-v3: Add changes file for prop305 implementation
by nickm＠torproject.org 09 Sep '19

09 Sep '19

commit f95b5d07c1a0407a60ca6335c032ec7a01b28968 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Aug 14 11:15:39 2019 -0400 hs-v3: Add changes file for prop305 implementation Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket30924 | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/changes/ticket30924 b/changes/ticket30924 new file mode 100644 index 000000000..832c37797 --- /dev/null +++ b/changes/ticket30924 @@ -0,0 +1,6 @@ + o Major features (onion service v3, denial of service): + - Add onion service introduction denial of service defenses. They consist of + rate limiting client introduction at the intro point using parameters that + can be sent by the service within the ESTABLISH_INTRO cell. If the cell + extension for this is not used, the intro point will honor the consensus + parameters. Closes ticket 30924.

1 0

[tor/master] hs-v3: Cleanup usage of consensus param in hs_dos.c
by nickm＠torproject.org 09 Sep '19

09 Sep '19

commit 184c76e339fdf25ea5f61ed052810cd5f356852e Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Aug 20 08:41:15 2019 -0400 hs-v3: Cleanup usage of consensus param in hs_dos.c This commit makes it that the hs_dos.c file only uses the consensus parameter variables set when we initialize and when the consensus changes. There is no need to call each time networkstatus_get_param(), which is expensive, when we want access to a consensus value. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/hs/hs_dos.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/src/feature/hs/hs_dos.c b/src/feature/hs/hs_dos.c index 0eb306977..cf663396f 100644 --- a/src/feature/hs/hs_dos.c +++ b/src/feature/hs/hs_dos.c @@ -54,7 +54,7 @@ static uint32_t param_introduce_defense_enabled = HS_DOS_INTRODUCE_ENABLED_DEFAULT; static uint32_t -get_param_intro_dos_enabled(const networkstatus_t *ns) +get_intro2_enable_consensus_param(const networkstatus_t *ns) { return networkstatus_get_param(ns, "HiddenServiceEnableIntroDoSDefense", HS_DOS_INTRODUCE_ENABLED_DEFAULT, 0, 1); @@ -62,7 +62,7 @@ get_param_intro_dos_enabled(const networkstatus_t *ns) /* Return the parameter for the introduction rate per sec. */ static uint32_t -get_param_rate_per_sec(const networkstatus_t *ns) +get_intro2_rate_consensus_param(const networkstatus_t *ns) { return networkstatus_get_param(ns, "HiddenServiceEnableIntroDoSRatePerSec", HS_DOS_INTRODUCE_DEFAULT_CELL_RATE_PER_SEC, @@ -71,7 +71,7 @@ get_param_rate_per_sec(const networkstatus_t *ns) /* Return the parameter for the introduction burst per sec. */ static uint32_t -get_param_burst_per_sec(const networkstatus_t *ns) +get_intro2_burst_consensus_param(const networkstatus_t *ns) { return networkstatus_get_param(ns, "HiddenServiceEnableIntroDoSBurstPerSec", HS_DOS_INTRODUCE_DEFAULT_CELL_BURST_PER_SEC, @@ -90,8 +90,8 @@ update_intro_circuits(void) SMARTLIST_FOREACH_BEGIN(intro_circs, circuit_t *, circ) { /* Adjust the rate/burst value that might have changed. */ token_bucket_ctr_adjust(&TO_OR_CIRCUIT(circ)->introduce2_bucket, - hs_dos_get_intro2_rate_param(), - hs_dos_get_intro2_burst_param()); + param_introduce_rate_per_sec, + param_introduce_burst_per_sec); } SMARTLIST_FOREACH_END(circ); smartlist_free(intro_circs); @@ -101,9 +101,9 @@ update_intro_circuits(void) static void set_consensus_parameters(const networkstatus_t *ns) { - param_introduce_rate_per_sec = get_param_rate_per_sec(ns); - param_introduce_burst_per_sec = get_param_burst_per_sec(ns); - param_introduce_defense_enabled = get_param_intro_dos_enabled(ns); + param_introduce_rate_per_sec = get_intro2_rate_consensus_param(ns); + param_introduce_burst_per_sec = get_intro2_burst_consensus_param(ns); + param_introduce_defense_enabled = get_intro2_enable_consensus_param(ns); /* The above might have changed which means we need to go through all * introduction circuits (relay side) and update the token buckets. */ @@ -143,10 +143,10 @@ hs_dos_setup_default_intro2_defenses(or_circuit_t *circ) { tor_assert(circ); - circ->introduce2_dos_defense_enabled = get_param_intro_dos_enabled(NULL); + circ->introduce2_dos_defense_enabled = param_introduce_defense_enabled; token_bucket_ctr_init(&circ->introduce2_bucket, - get_param_rate_per_sec(NULL), - get_param_burst_per_sec(NULL), + param_introduce_rate_per_sec, + param_introduce_burst_per_sec, (uint32_t) approx_time()); }

1 0

[tor/master] man: Entry for the HS intro DoS defenses
by nickm＠torproject.org 09 Sep '19

09 Sep '19

commit e5cf1423fdc1707093885e5d74f0691de3365b55 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Aug 14 11:11:59 2019 -0400 man: Entry for the HS intro DoS defenses This also adds a "subsection" to the HIDDEN SERVICE OPTIONS section to seperate per-service and per-instance options. It is a bit less messy this way. The HS DoS options are added to the per-service section. Part of #30924 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- doc/tor.1.txt | 46 +++++++++++++++++++++++++++++++++++++++------- 1 file changed, 39 insertions(+), 7 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 362c40990..835962362 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2915,7 +2915,13 @@ on the public Tor network. HIDDEN SERVICE OPTIONS ---------------------- -The following options are used to configure a hidden service. +The following options are used to configure a hidden service. Some options +apply per service and some apply for the whole tor instance. + +The next section describes the per service options that can only be set +**after** the **HiddenServiceDir** directive + +**PER SERVICE OPTIONS:** [[HiddenServiceDir]] **HiddenServiceDir** __DIRECTORY__:: Store data files for a hidden service in DIRECTORY. Every hidden service @@ -2941,12 +2947,6 @@ The following options are used to configure a hidden service. connects to that VIRTPORT, one of the TARGETs from those lines will be chosen at random. Note that address-port pairs have to be comma-separated. -[[PublishHidServDescriptors]] **PublishHidServDescriptors** **0**|**1**:: - If set to 0, Tor will run any hidden services you configure, but it won't - advertise them to the rendezvous directory. This option is only useful if - you're using a Tor controller that handles hidserv publishing for you. - (Default: 1) - [[HiddenServiceVersion]] **HiddenServiceVersion** **2**|**3**:: A list of rendezvous service descriptor versions to publish for the hidden service. Currently, versions 2 and 3 are supported. (Default: 3) @@ -3025,6 +3025,38 @@ The following options are used to configure a hidden service. Number of introduction points the hidden service will have. You can't have more than 10 for v2 service and 20 for v3. (Default: 3) +[[HiddenServiceEnableIntroDoSDefense]] **HiddenServiceEnableIntroDoSDefense** **0**|**1**:: + Enable DoS defense at the intropoint level. When this is enabled, the + rate and burst parameter (see below) will be sent to the intro point which + will then use them to apply rate limiting for introduction request to this + service. + + + The introduction point honors the consensus parameters except if this is + specifically set by the service operator using this option. The service + never looks at the consensus parameters in order to enable or disable this + defense. (Default: 0) + +[[HiddenServiceEnableIntroDoSRatePerSec]] **HiddenServiceEnableIntroDoSRatePerSec** __NUM__:: + The allowed client introduction rate per second at the introduction + point. If this option is 0, it is considered infinite and thus if + **HiddenServiceEnableIntroDoSDefense** is set, it then effectively + disables the defenses. (Default: 25) + +[[HiddenServiceEnableIntroDoSBurstPerSec]] **HiddenServiceEnableIntroDoSBurstPerSec** __NUM__:: + The allowed client introduction burst per second at the introduction + point. If this option is 0, it is considered infinite and thus if + **HiddenServiceEnableIntroDoSDefense** is set, it then effectively + disables the defenses. (Default: 200) + + +**PER INSTANCE OPTIONS:** + +[[PublishHidServDescriptors]] **PublishHidServDescriptors** **0**|**1**:: + If set to 0, Tor will run any hidden services you configure, but it won't + advertise them to the rendezvous directory. This option is only useful if + you're using a Tor controller that handles hidserv publishing for you. + (Default: 1) + [[HiddenServiceSingleHopMode]] **HiddenServiceSingleHopMode** **0**|**1**:: **Experimental - Non Anonymous** Hidden Services on a tor instance in HiddenServiceSingleHopMode make one-hop (direct) circuits between the onion

1 0

[tor/master] hs-v3: Missing intro circuit INTRO2 DoS enabled flag
by nickm＠torproject.org 09 Sep '19

09 Sep '19

commit a98f5099c4c58c25826835fbfc3ce708e5d378fd Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Aug 20 08:55:26 2019 -0400 hs-v3: Missing intro circuit INTRO2 DoS enabled flag When consensus changes, we also need to update the circuit INTRO2 defenses enabled flag and not only the token bucket. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/hs/hs_dos.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/feature/hs/hs_dos.c b/src/feature/hs/hs_dos.c index a7a43b9bc..c7d420195 100644 --- a/src/feature/hs/hs_dos.c +++ b/src/feature/hs/hs_dos.c @@ -88,6 +88,9 @@ update_intro_circuits(void) smartlist_t *intro_circs = hs_circuitmap_get_all_intro_circ_relay_side(); SMARTLIST_FOREACH_BEGIN(intro_circs, circuit_t *, circ) { + /* Defenses might have been enabled or disabled. */ + TO_OR_CIRCUIT(circ)->introduce2_dos_defense_enabled = + consensus_param_introduce_defense_enabled; /* Adjust the rate/burst value that might have changed. */ token_bucket_ctr_adjust(&TO_OR_CIRCUIT(circ)->introduce2_bucket, consensus_param_introduce_rate_per_sec,

1 0

[tor/master] hs-v3: Privatize access to HS DoS consensus param
by nickm＠torproject.org 09 Sep '19

09 Sep '19

commit 94a22217082f99bb7d5409e22af69d45def52889 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Aug 20 08:52:34 2019 -0400 hs-v3: Privatize access to HS DoS consensus param Remove the public functions returning the HS DoS consensus param or default values as it is exclusively used internally now. Rename the param_* variables to consensus_param_* for better code semantic. Finally, make some private functions available to unit tests. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/hs/hs_dos.c | 53 +++++++++++++++++-------------------------------- src/feature/hs/hs_dos.h | 8 ++++---- src/test/test_hs_dos.c | 18 ++++++++--------- 3 files changed, 30 insertions(+), 49 deletions(-) diff --git a/src/feature/hs/hs_dos.c b/src/feature/hs/hs_dos.c index cf663396f..a7a43b9bc 100644 --- a/src/feature/hs/hs_dos.c +++ b/src/feature/hs/hs_dos.c @@ -46,14 +46,14 @@ #define HS_DOS_INTRODUCE_ENABLED_DEFAULT 0 /* Consensus parameters. */ -static uint32_t param_introduce_rate_per_sec = +static uint32_t consensus_param_introduce_rate_per_sec = HS_DOS_INTRODUCE_DEFAULT_CELL_RATE_PER_SEC; -static uint32_t param_introduce_burst_per_sec = +static uint32_t consensus_param_introduce_burst_per_sec = HS_DOS_INTRODUCE_DEFAULT_CELL_BURST_PER_SEC; -static uint32_t param_introduce_defense_enabled = +static uint32_t consensus_param_introduce_defense_enabled = HS_DOS_INTRODUCE_ENABLED_DEFAULT; -static uint32_t +STATIC uint32_t get_intro2_enable_consensus_param(const networkstatus_t *ns) { return networkstatus_get_param(ns, "HiddenServiceEnableIntroDoSDefense", @@ -61,7 +61,7 @@ get_intro2_enable_consensus_param(const networkstatus_t *ns) } /* Return the parameter for the introduction rate per sec. */ -static uint32_t +STATIC uint32_t get_intro2_rate_consensus_param(const networkstatus_t *ns) { return networkstatus_get_param(ns, "HiddenServiceEnableIntroDoSRatePerSec", @@ -70,7 +70,7 @@ get_intro2_rate_consensus_param(const networkstatus_t *ns) } /* Return the parameter for the introduction burst per sec. */ -static uint32_t +STATIC uint32_t get_intro2_burst_consensus_param(const networkstatus_t *ns) { return networkstatus_get_param(ns, "HiddenServiceEnableIntroDoSBurstPerSec", @@ -90,8 +90,8 @@ update_intro_circuits(void) SMARTLIST_FOREACH_BEGIN(intro_circs, circuit_t *, circ) { /* Adjust the rate/burst value that might have changed. */ token_bucket_ctr_adjust(&TO_OR_CIRCUIT(circ)->introduce2_bucket, - param_introduce_rate_per_sec, - param_introduce_burst_per_sec); + consensus_param_introduce_rate_per_sec, + consensus_param_introduce_burst_per_sec); } SMARTLIST_FOREACH_END(circ); smartlist_free(intro_circs); @@ -101,9 +101,12 @@ update_intro_circuits(void) static void set_consensus_parameters(const networkstatus_t *ns) { - param_introduce_rate_per_sec = get_intro2_rate_consensus_param(ns); - param_introduce_burst_per_sec = get_intro2_burst_consensus_param(ns); - param_introduce_defense_enabled = get_intro2_enable_consensus_param(ns); + consensus_param_introduce_rate_per_sec = + get_intro2_rate_consensus_param(ns); + consensus_param_introduce_burst_per_sec = + get_intro2_burst_consensus_param(ns); + consensus_param_introduce_defense_enabled = + get_intro2_enable_consensus_param(ns); /* The above might have changed which means we need to go through all * introduction circuits (relay side) and update the token buckets. */ @@ -114,27 +117,6 @@ set_consensus_parameters(const networkstatus_t *ns) * Public API. */ -/* Return the INTRODUCE2 cell rate per second (param or default). */ -uint32_t -hs_dos_get_intro2_rate_param(void) -{ - return param_introduce_rate_per_sec; -} - -/* Return the INTRODUCE2 cell burst per second (param or default). */ -uint32_t -hs_dos_get_intro2_burst_param(void) -{ - return param_introduce_burst_per_sec; -} - -/* Return the INTRODUCE2 DoS defense enabled flag (param or default). */ -unsigned int -hs_dos_get_intro2_enabled_param(void) -{ - return (unsigned int) param_introduce_defense_enabled; -} - /* Initialize the INTRODUCE2 token bucket for the DoS defenses using the * consensus/default values. We might get a cell extension that changes those * later but if we don't, the default or consensus parameters are used. */ @@ -143,10 +125,11 @@ hs_dos_setup_default_intro2_defenses(or_circuit_t *circ) { tor_assert(circ); - circ->introduce2_dos_defense_enabled = param_introduce_defense_enabled; + circ->introduce2_dos_defense_enabled = + consensus_param_introduce_defense_enabled; token_bucket_ctr_init(&circ->introduce2_bucket, - param_introduce_rate_per_sec, - param_introduce_burst_per_sec, + consensus_param_introduce_rate_per_sec, + consensus_param_introduce_burst_per_sec, (uint32_t) approx_time()); } diff --git a/src/feature/hs/hs_dos.h b/src/feature/hs/hs_dos.h index 1d2dd67d0..6647b24be 100644 --- a/src/feature/hs/hs_dos.h +++ b/src/feature/hs/hs_dos.h @@ -24,14 +24,14 @@ void hs_dos_consensus_has_changed(const networkstatus_t *ns); bool hs_dos_can_send_intro2(or_circuit_t *s_intro_circ); void hs_dos_setup_default_intro2_defenses(or_circuit_t *circ); -unsigned int hs_dos_get_intro2_enabled_param(void); -uint32_t hs_dos_get_intro2_rate_param(void); -uint32_t hs_dos_get_intro2_burst_param(void); - #ifdef HS_DOS_PRIVATE #ifdef TOR_UNIT_TESTS +STATIC uint32_t get_intro2_enable_consensus_param(const networkstatus_t *ns); +STATIC uint32_t get_intro2_rate_consensus_param(const networkstatus_t *ns); +STATIC uint32_t get_intro2_burst_consensus_param(const networkstatus_t *ns); + #endif /* define(TOR_UNIT_TESTS) */ #endif /* defined(HS_DOS_PRIVATE) */ diff --git a/src/test/test_hs_dos.c b/src/test/test_hs_dos.c index f92d953fa..370e12bf7 100644 --- a/src/test/test_hs_dos.c +++ b/src/test/test_hs_dos.c @@ -8,6 +8,7 @@ #define CIRCUITLIST_PRIVATE #define NETWORKSTATUS_PRIVATE +#define HS_DOS_PRIVATE #include "test/test.h" #include "test/test_helpers.h" @@ -57,11 +58,8 @@ test_can_send_intro2(void *arg) /* Make that circuit a service intro point. */ circuit_change_purpose(TO_CIRCUIT(or_circ), CIRCUIT_PURPOSE_INTRO_POINT); + hs_dos_setup_default_intro2_defenses(or_circ); or_circ->introduce2_dos_defense_enabled = 1; - /* Initialize the INTRODUCE2 token bucket for the rate limiting. */ - token_bucket_ctr_init(&or_circ->introduce2_bucket, - hs_dos_get_intro2_rate_param(), - hs_dos_get_intro2_burst_param(), now); /* Brand new circuit, we should be able to send INTRODUCE2 cells. */ tt_int_op(true, OP_EQ, hs_dos_can_send_intro2(or_circ)); @@ -73,13 +71,13 @@ test_can_send_intro2(void *arg) tt_int_op(true, OP_EQ, hs_dos_can_send_intro2(or_circ)); } tt_uint_op(token_bucket_ctr_get(&or_circ->introduce2_bucket), OP_EQ, - hs_dos_get_intro2_burst_param() - 10); + get_intro2_burst_consensus_param(NULL) - 10); /* Fully refill the bucket minus 1 cell. */ update_approx_time(++now); tt_int_op(true, OP_EQ, hs_dos_can_send_intro2(or_circ)); tt_uint_op(token_bucket_ctr_get(&or_circ->introduce2_bucket), OP_EQ, - hs_dos_get_intro2_burst_param() - 1); + get_intro2_burst_consensus_param(NULL) - 1); /* Receive an INTRODUCE2 at each second. We should have the bucket full * since at every second it gets refilled. */ @@ -89,18 +87,18 @@ test_can_send_intro2(void *arg) } /* Last check if we can send the cell decrements the bucket so minus 1. */ tt_uint_op(token_bucket_ctr_get(&or_circ->introduce2_bucket), OP_EQ, - hs_dos_get_intro2_burst_param() - 1); + get_intro2_burst_consensus_param(NULL) - 1); /* Manually reset bucket for next test. */ token_bucket_ctr_reset(&or_circ->introduce2_bucket, now); tt_uint_op(token_bucket_ctr_get(&or_circ->introduce2_bucket), OP_EQ, - hs_dos_get_intro2_burst_param()); + get_intro2_burst_consensus_param(NULL)); /* Do a full burst in the current second which should empty the bucket and * we shouldn't be allowed to send one more cell after that. We go minus 1 * cell else the very last check if we can send the INTRO2 cell returns * false because the bucket goes down to 0. */ - for (uint32_t i = 0; i < hs_dos_get_intro2_burst_param() - 1; i++) { + for (uint32_t i = 0; i < get_intro2_burst_consensus_param(NULL) - 1; i++) { tt_int_op(true, OP_EQ, hs_dos_can_send_intro2(or_circ)); } tt_uint_op(token_bucket_ctr_get(&or_circ->introduce2_bucket), OP_EQ, 1); @@ -118,7 +116,7 @@ test_can_send_intro2(void *arg) update_approx_time(++now); tt_int_op(true, OP_EQ, hs_dos_can_send_intro2(or_circ)); tt_uint_op(token_bucket_ctr_get(&or_circ->introduce2_bucket), OP_EQ, - hs_dos_get_intro2_rate_param() - 1); + get_intro2_rate_consensus_param(NULL) - 1); done: circuit_free_(TO_CIRCUIT(or_circ));

1 0

[tor/master] hs-v3: Refactor DoS cell extension parameters validation
by nickm＠torproject.org 09 Sep '19

09 Sep '19

commit 461d231289584110bde37ab498db3631fb6b0cf1 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Aug 20 09:38:13 2019 -0400 hs-v3: Refactor DoS cell extension parameters validation Move everything to its own function in order to better log, document and tests the introduction point validation process. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/hs/hs_config.h | 3 +- src/feature/hs/hs_intropoint.c | 91 +++++++++++++++++++++++++++++++++--------- src/feature/hs/hs_intropoint.h | 3 ++ src/test/test_hs_dos.c | 43 ++++++++++++++++++++ 4 files changed, 120 insertions(+), 20 deletions(-) diff --git a/src/feature/hs/hs_config.h b/src/feature/hs/hs_config.h index 249e19309..beefc7a61 100644 --- a/src/feature/hs/hs_config.h +++ b/src/feature/hs/hs_config.h @@ -15,7 +15,8 @@ #define HS_CONFIG_MAX_STREAMS_PER_RDV_CIRCUIT 65535 /* Maximum number of intro points per version 3 services. */ #define HS_CONFIG_V3_MAX_INTRO_POINTS 20 -/* Default value for the introduction DoS defenses. */ +/* Default value for the introduction DoS defenses. The MIN/MAX are inclusive + * meaning they can be used as valid values. */ #define HS_CONFIG_V3_DOS_DEFENSE_DEFAULT 0 #define HS_CONFIG_V3_DOS_DEFENSE_RATE_PER_SEC_DEFAULT 25 #define HS_CONFIG_V3_DOS_DEFENSE_RATE_PER_SEC_MIN 0 diff --git a/src/feature/hs/hs_intropoint.c b/src/feature/hs/hs_intropoint.c index fc7d96194..9b6a96628 100644 --- a/src/feature/hs/hs_intropoint.c +++ b/src/feature/hs/hs_intropoint.c @@ -182,6 +182,59 @@ hs_intro_send_intro_established_cell,(or_circuit_t *circ)) return ret; } +/* Validate the cell DoS extension parameters. Return true iff they've been + * bound check and can be used. Else return false. See proposal 305 for + * details and reasons about this validation. */ +STATIC bool +validate_cell_dos_extension_parameters(uint64_t intro2_rate_per_sec, + uint64_t intro2_burst_per_sec) +{ + bool ret = false; + + /* A value of 0 is valid in the sense that we accept it but we still disable + * the defenses so return false. */ + if (intro2_rate_per_sec == 0 || intro2_burst_per_sec == 0) { + log_info(LD_REND, "Intro point DoS defenses parameter set to 0."); + goto end; + } + + /* Bound check the received rate per second. MIN/MAX are inclusive. */ + if (!(intro2_rate_per_sec <= HS_CONFIG_V3_DOS_DEFENSE_RATE_PER_SEC_MAX && + intro2_rate_per_sec > HS_CONFIG_V3_DOS_DEFENSE_RATE_PER_SEC_MIN)) { + log_info(LD_REND, "Intro point DoS defenses rate per second is " + "invalid. Received value: %" PRIu64, + intro2_rate_per_sec); + goto end; + } + + /* Bound check the received burst per second. MIN/MAX are inclusive. */ + if (!(intro2_burst_per_sec <= HS_CONFIG_V3_DOS_DEFENSE_BURST_PER_SEC_MAX && + intro2_burst_per_sec > HS_CONFIG_V3_DOS_DEFENSE_BURST_PER_SEC_MIN)) { + log_info(LD_REND, "Intro point DoS defenses burst per second is " + "invalid. Received value: %" PRIu64, + intro2_burst_per_sec); + goto end; + } + + /* In a rate limiting scenario, burst can never be smaller than the rate. At + * best it can be equal. */ + if (intro2_burst_per_sec < intro2_rate_per_sec) { + log_info(LD_REND, "Intro point DoS defenses burst is smaller than rate. " + "Rate: %" PRIu64 " vs Burst: %" PRIu64, + intro2_rate_per_sec, intro2_burst_per_sec); + goto end; + } + + /* Passing validation. */ + ret = true; + + end: + return ret; +} + +/* Parse the cell DoS extension and apply defenses on the given circuit if + * validation passes. If the cell extension is malformed or contains unusable + * values, the DoS defenses is disabled on the circuit. */ static void handle_establish_intro_cell_dos_extension( const trn_cell_extension_field_t *field, @@ -220,33 +273,33 @@ handle_establish_intro_cell_dos_extension( } } - /* Validation. A value of 0 on either of them means the defenses are - * disabled so we ignore. */ - if ((intro2_rate_per_sec > HS_CONFIG_V3_DOS_DEFENSE_BURST_PER_SEC_MAX || - intro2_rate_per_sec <= HS_CONFIG_V3_DOS_DEFENSE_RATE_PER_SEC_MIN) || - (intro2_burst_per_sec > HS_CONFIG_V3_DOS_DEFENSE_RATE_PER_SEC_MAX || - intro2_burst_per_sec <= HS_CONFIG_V3_DOS_DEFENSE_BURST_PER_SEC_MIN) || - (intro2_burst_per_sec < intro2_rate_per_sec)) { + /* If invalid, we disable the defense on the circuit. */ + if (!validate_cell_dos_extension_parameters(intro2_rate_per_sec, + intro2_burst_per_sec)) { circ->introduce2_dos_defense_enabled = 0; - log_info(LD_REND, "Intro point DoS defenses disabled due to bad values"); - } else { - circ->introduce2_dos_defense_enabled = 1; - - /* Initialize the INTRODUCE2 token bucket for the rate limiting. */ - token_bucket_ctr_init(&circ->introduce2_bucket, - (uint32_t) intro2_rate_per_sec, - (uint32_t) intro2_burst_per_sec, - (uint32_t) approx_time()); - log_debug(LD_REND, "Intro point DoS defenses enabled. Rate is %" PRIu64 - " and Burst is %" PRIu64, intro2_rate_per_sec, - intro2_burst_per_sec); + log_info(LD_REND, "Disabling INTRO2 DoS defenses on circuit id %u", + circ->p_circ_id); + goto end; } + /* We passed validation, enable defenses and apply rate/burst. */ + circ->introduce2_dos_defense_enabled = 1; + + /* Initialize the INTRODUCE2 token bucket for the rate limiting. */ + token_bucket_ctr_init(&circ->introduce2_bucket, + (uint32_t) intro2_rate_per_sec, + (uint32_t) intro2_burst_per_sec, + (uint32_t) approx_time()); + log_info(LD_REND, "Intro point DoS defenses enabled. Rate is %" PRIu64 + " and Burst is %" PRIu64, + intro2_rate_per_sec, intro2_burst_per_sec); + end: trn_cell_extension_dos_free(dos); return; } +/* Parse every cell extension in the given ESTABLISH_INTRO cell. */ static void handle_establish_intro_cell_extensions( const trn_cell_establish_intro_t *parsed_cell, diff --git a/src/feature/hs/hs_intropoint.h b/src/feature/hs/hs_intropoint.h index e82575f05..1bebcacd8 100644 --- a/src/feature/hs/hs_intropoint.h +++ b/src/feature/hs/hs_intropoint.h @@ -57,6 +57,9 @@ STATIC int handle_introduce1(or_circuit_t *client_circ, const uint8_t *request, size_t request_len); STATIC int validate_introduce1_parsed_cell(const trn_cell_introduce1_t *cell); STATIC int circuit_is_suitable_for_introduce1(const or_circuit_t *circ); +STATIC bool validate_cell_dos_extension_parameters( + uint64_t intro2_rate_per_sec, + uint64_t intro2_burst_per_sec); #endif /* defined(HS_INTROPOINT_PRIVATE) */ diff --git a/src/test/test_hs_dos.c b/src/test/test_hs_dos.c index 370e12bf7..25a04d779 100644 --- a/src/test/test_hs_dos.c +++ b/src/test/test_hs_dos.c @@ -9,6 +9,7 @@ #define CIRCUITLIST_PRIVATE #define NETWORKSTATUS_PRIVATE #define HS_DOS_PRIVATE +#define HS_INTROPOINT_PRIVATE #include "test/test.h" #include "test/test_helpers.h" @@ -21,6 +22,7 @@ #include "core/or/or_circuit_st.h" #include "feature/hs/hs_dos.h" +#include "feature/hs/hs_intropoint.h" #include "feature/nodelist/networkstatus.h" static void @@ -125,9 +127,50 @@ test_can_send_intro2(void *arg) free_mock_consensus(); } +static void +test_validate_dos_extension_params(void *arg) +{ + bool ret; + + (void) arg; + + /* Validate the default values. */ + ret = validate_cell_dos_extension_parameters( + get_intro2_rate_consensus_param(NULL), + get_intro2_burst_consensus_param(NULL)); + tt_assert(ret); + + /* Valid custom rate/burst. */ + ret = validate_cell_dos_extension_parameters(17, 42); + tt_assert(ret); + + /* Invalid rate. */ + ret = validate_cell_dos_extension_parameters(UINT64_MAX, 42); + tt_assert(!ret); + + /* Invalid burst. */ + ret = validate_cell_dos_extension_parameters(42, UINT64_MAX); + tt_assert(!ret); + + /* Value of 0 should return invalid so defenses can be disabled. */ + ret = validate_cell_dos_extension_parameters(0, 42); + tt_assert(!ret); + ret = validate_cell_dos_extension_parameters(42, 0); + tt_assert(!ret); + + /* Can't have burst smaller than rate. */ + ret = validate_cell_dos_extension_parameters(42, 40); + tt_assert(!ret); + + done: + return; +} + struct testcase_t hs_dos_tests[] = { { "can_send_intro2", test_can_send_intro2, TT_FORK, NULL, NULL }, + { "validate_dos_extension_params", test_validate_dos_extension_params, + TT_FORK, NULL, NULL }, END_OF_TESTCASES };

1 0

[tor/master] hs-v3: Log info INTRO2 DoS defenses service values
by nickm＠torproject.org 09 Sep '19

09 Sep '19

commit 292e9b0c002fb695f77665d86908bb5cb1759ee6 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Aug 20 09:04:43 2019 -0400 hs-v3: Log info INTRO2 DoS defenses service values Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/hs/hs_config.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/feature/hs/hs_config.c b/src/feature/hs/hs_config.c index 51558f323..7424d7d3c 100644 --- a/src/feature/hs/hs_config.c +++ b/src/feature/hs/hs_config.c @@ -374,6 +374,8 @@ config_service_v3(const config_line_t *line_, goto err; } dos_rate_per_sec = true; + log_info(LD_REND, "Service INTRO2 DoS defenses rate set to: %" PRIu32, + config->intro_dos_rate_per_sec); continue; } if (!strcasecmp(line->key, "HiddenServiceEnableIntroDoSBurstPerSec")) { @@ -388,6 +390,8 @@ config_service_v3(const config_line_t *line_, goto err; } dos_burst_per_sec = true; + log_info(LD_REND, "Service INTRO2 DoS defenses burst set to: %" PRIu32, + config->intro_dos_burst_per_sec); continue; } }

1 0

[tor/master] hs-v3: Clarify comment in hs_dos.c
by nickm＠torproject.org 09 Sep '19

09 Sep '19

commit 1c4607b13254942256b869ff0044d205518cc949 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Aug 20 09:10:08 2019 -0400 hs-v3: Clarify comment in hs_dos.c Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/hs/hs_dos.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/feature/hs/hs_dos.c b/src/feature/hs/hs_dos.c index c7d420195..0ae36017f 100644 --- a/src/feature/hs/hs_dos.c +++ b/src/feature/hs/hs_dos.c @@ -45,7 +45,9 @@ * introduction DoS defense. Disabled by default. */ #define HS_DOS_INTRODUCE_ENABLED_DEFAULT 0 -/* Consensus parameters. */ +/* Consensus parameters. The ESTABLISH_INTRO DoS cell extension have higher + * priority than these values. If no extension is sent, these are used only by + * the introduction point. */ static uint32_t consensus_param_introduce_rate_per_sec = HS_DOS_INTRODUCE_DEFAULT_CELL_RATE_PER_SEC; static uint32_t consensus_param_introduce_burst_per_sec =

1 0

[tor/master] hs-v3: Move DoS parameter check against 0
by nickm＠torproject.org 09 Sep '19

09 Sep '19

commit 385f6bcfccbc327f42e5139ac8136086e79fbb17 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Aug 20 10:50:31 2019 -0400 hs-v3: Move DoS parameter check against 0 Move it outside of the validation function since 0 is a valid value but disables defenses. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/hs/hs_intropoint.c | 54 +++++++++++++++++++++++++++++------------- src/test/test_hs_dos.c | 11 ++++----- 2 files changed, 43 insertions(+), 22 deletions(-) diff --git a/src/feature/hs/hs_intropoint.c b/src/feature/hs/hs_intropoint.c index 9b6a96628..fb2ac52e5 100644 --- a/src/feature/hs/hs_intropoint.c +++ b/src/feature/hs/hs_intropoint.c @@ -191,28 +191,40 @@ validate_cell_dos_extension_parameters(uint64_t intro2_rate_per_sec, { bool ret = false; - /* A value of 0 is valid in the sense that we accept it but we still disable - * the defenses so return false. */ - if (intro2_rate_per_sec == 0 || intro2_burst_per_sec == 0) { - log_info(LD_REND, "Intro point DoS defenses parameter set to 0."); + /* Check that received value is not below the minimum. Don't check if minimum + is set to 0, since the param is a positive value and gcc will complain. */ +#if HS_CONFIG_V3_DOS_DEFENSE_RATE_PER_SEC_MIN > 0 + if (intro2_rate_per_sec < HS_CONFIG_V3_DOS_DEFENSE_RATE_PER_SEC_MIN) { + log_fn(LOG_PROTOCOL_WARN, LD_REND, + "Intro point DoS defenses rate per second is " + "too small. Received value: %" PRIu64, intro2_rate_per_sec); goto end; } +#endif - /* Bound check the received rate per second. MIN/MAX are inclusive. */ - if (!(intro2_rate_per_sec <= HS_CONFIG_V3_DOS_DEFENSE_RATE_PER_SEC_MAX && - intro2_rate_per_sec > HS_CONFIG_V3_DOS_DEFENSE_RATE_PER_SEC_MIN)) { - log_info(LD_REND, "Intro point DoS defenses rate per second is " - "invalid. Received value: %" PRIu64, - intro2_rate_per_sec); + /* Check that received value is not above maximum */ + if (intro2_rate_per_sec > HS_CONFIG_V3_DOS_DEFENSE_RATE_PER_SEC_MAX) { + log_fn(LOG_PROTOCOL_WARN, LD_REND, + "Intro point DoS defenses rate per second is " + "too big. Received value: %" PRIu64, intro2_rate_per_sec); + goto end; + } + + /* Check that received value is not below the minimum */ +#if HS_CONFIG_V3_DOS_DEFENSE_BURST_PER_SEC_MIN > 0 + if (intro2_burst_per_sec < HS_CONFIG_V3_DOS_DEFENSE_BURST_PER_SEC_MIN) { + log_fn(LOG_PROTOCOL_WARN, LD_REND, + "Intro point DoS defenses burst per second is " + "too small. Received value: %" PRIu64, intro2_burst_per_sec); goto end; } +#endif - /* Bound check the received burst per second. MIN/MAX are inclusive. */ - if (!(intro2_burst_per_sec <= HS_CONFIG_V3_DOS_DEFENSE_BURST_PER_SEC_MAX && - intro2_burst_per_sec > HS_CONFIG_V3_DOS_DEFENSE_BURST_PER_SEC_MIN)) { - log_info(LD_REND, "Intro point DoS defenses burst per second is " - "invalid. Received value: %" PRIu64, - intro2_burst_per_sec); + /* Check that received value is not above maximum */ + if (intro2_burst_per_sec > HS_CONFIG_V3_DOS_DEFENSE_BURST_PER_SEC_MAX) { + log_fn(LOG_PROTOCOL_WARN, LD_REND, + "Intro point DoS defenses burst per second is " + "too big. Received value: %" PRIu64, intro2_burst_per_sec); goto end; } @@ -273,6 +285,16 @@ handle_establish_intro_cell_dos_extension( } } + /* A value of 0 is valid in the sense that we accept it but we still disable + * the defenses so return false. */ + if (intro2_rate_per_sec == 0 || intro2_burst_per_sec == 0) { + log_info(LD_REND, "Intro point DoS defenses parameter set to 0. " + "Disabling INTRO2 DoS defenses on circuit id %u", + circ->p_circ_id); + circ->introduce2_dos_defense_enabled = 0; + goto end; + } + /* If invalid, we disable the defense on the circuit. */ if (!validate_cell_dos_extension_parameters(intro2_rate_per_sec, intro2_burst_per_sec)) { diff --git a/src/test/test_hs_dos.c b/src/test/test_hs_dos.c index 25a04d779..03c755acb 100644 --- a/src/test/test_hs_dos.c +++ b/src/test/test_hs_dos.c @@ -143,6 +143,8 @@ test_validate_dos_extension_params(void *arg) /* Valid custom rate/burst. */ ret = validate_cell_dos_extension_parameters(17, 42); tt_assert(ret); + ret = cell_dos_extension_parameters_are_valid(INT32_MAX, INT32_MAX); + tt_assert(ret); /* Invalid rate. */ ret = validate_cell_dos_extension_parameters(UINT64_MAX, 42); @@ -152,11 +154,9 @@ test_validate_dos_extension_params(void *arg) ret = validate_cell_dos_extension_parameters(42, UINT64_MAX); tt_assert(!ret); - /* Value of 0 should return invalid so defenses can be disabled. */ - ret = validate_cell_dos_extension_parameters(0, 42); - tt_assert(!ret); - ret = validate_cell_dos_extension_parameters(42, 0); - tt_assert(!ret); + /* Value of 0 is valid (but should disable defenses) */ + ret = cell_dos_extension_parameters_are_valid(0, 0); + tt_assert(ret); /* Can't have burst smaller than rate. */ ret = validate_cell_dos_extension_parameters(42, 40); @@ -174,4 +174,3 @@ struct testcase_t hs_dos_tests[] = { END_OF_TESTCASES }; -

1 0