dos: Detect circuit creation denial of service

Add a function that notifies the DoS subsystem that a new CREATE cell has
arrived. The statistics are updated accordingly and the IP address can also be
marked as malicious if it is above threshold.

At this commit, no defense is applied, just detection with a circuit creation
token bucket system.

Signed-off-by: David Goulet <dgoulet@torproject.org>

1 files changed, 6 insertions, 0 deletions

diff --git a/src/or/dos.h b/src/or/dos.h
index 3cc10d3f99..bb8d7d1a79 100644
--- a/src/or/dos.h
+++ b/src/or/dos.h
@@ -80,6 +80,8 @@ typedef enum dos_cc_defense_type_t {
   DOS_CC_DEFENSE_MAX              = 2,
 } dos_cc_defense_type_t;
 
+void dos_cc_new_create_cell(channel_t *channel);
+
 /*
  * Concurrent connection DoS mitigation interface.
  */
@@ -112,6 +114,10 @@ STATIC uint32_t get_param_cc_circuit_burst(const networkstatus_t *ns);
 STATIC uint32_t get_param_cc_min_concurrent_connection(
                                             const networkstatus_t *ns);
 
+STATIC uint32_t get_circuit_rate_per_second(void);
+STATIC void cc_stats_refill_bucket(cc_client_stats_t *stats,
+                                   const tor_addr_t *addr);
+
 MOCK_DECL(STATIC unsigned int, get_param_cc_enabled,
           (const networkstatus_t *ns));
 MOCK_DECL(STATIC unsigned int, get_param_conn_enabled,