aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-02-05geoip: Make geoip_client_cache_total_allocation() return the counterDavid Goulet
The HT_FOREACH() is insanely heavy on the CPU and this is part of the fast path so make it return the nice memory size counter we added in 4d812e29b9b1ec88. Fixes #25148 Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-02-02dos: We can put less token than the current amountDavid Goulet
Becasue the circuit creation burst and rate can change at runtime it is possible that between two refill of a bucket, we end up setting the bucket value to less than there currently is. Fixes #25128 Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-02-02Use tt_u64_op() for uint64_t inputs.Nick Mathewson
2018-02-02Merge branch 'ticket25122_029_02' into ticket24902_029_05David Goulet
2018-02-02geoip: Add clientmap_entry_new() functionDavid Goulet
Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-02-02geoip: Increment and decrement functions for the geoip client cacheDavid Goulet
These functions protect againts over and underflow. They BUG() in case we overflow the counter. Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-02-02geoip: Hook the client history cache into the OOM handlerDavid Goulet
If the cache is using 20% of our maximum allowed memory, clean 10% of it. Same behavior as the HS descriptor cache. Closes #25122 Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-02-01Merge remote-tracking branch 'teor/bug25070_031' into maint-0.3.1Nick Mathewson
2018-01-31channel_tls_get_remote_addr_method now returns real_addr.Fernando Fernandez Mancera
The accurate address of a connection is real_addr, not the addr member. channel_tls_get_remote_addr_method() now returns real_addr instead. Fixes #24952; bugfix on 707c1e2 in 0.2.4.11-alpha. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net>
2018-01-31But in most Earth cultures, there are 60s in a minute.Nick Mathewson
2018-01-31add a rate-limit.Nick Mathewson
2018-01-31test: Add unit tests for overflows and underflows in cc_stats_refill_bucketteor
Closes #25094. Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-01-31dos: Make sure cc_stats_refill_bucket can't overflow while calculatingteor
Debug log the elapsed time in cc_stats_refill_bucket Part of #25094. Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-01-31test: Remove a redundant round from test_dos_bucket_refillteor
This round is left over from the tenths of a second code. Part of #25094.
2018-01-30dos: Add changes file for ticket 24902David Goulet
Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-01-30dos: Make circuit rate limit per second, not tenths anymoreDavid Goulet
Because this touches too many commits at once, it is made into one single commit. Remove the use of "tenths" for the circuit rate to simplify things. We can only refill the buckets at best once every second because of the use of approx_time() and our token system is set to be 1 token = 1 circuit so make the rate a flat integer of circuit per second. Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-01-30dos: Man page entry for DoS mitigationDavid Goulet
Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-01-30test: Add unit tests for the DoS subsystemGeorge Kadianakis
Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-01-30dos: Clear connection tracked flag if geoip entry is removedDavid Goulet
Imagine this scenario. We had 10 connections over the 24h lifetime of a geoip cache entry. The lifetime of the entry has been reached so it is about to get freed but 2 connections remain for it. After the free, a third connection comes in thus making us create a new geoip entry for that address matching the 2 previous ones that are still alive. If they end up being closed, we'll have a concurrent count desynch from what the reality is. To mitigate this probably very rare scenario in practice, when we free a geoip entry and it has a concurrent count above 0, we'll go over all connections matching the address and clear out the tracked flag. So once they are closed, we don't try to decrement the count. Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-01-30dos: Add a heartbeat logDavid Goulet
Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-01-30dos: Add the DoSRefuseSingleHopClientRendezvous optionDavid Goulet
This option refuses any ESTABLISH_RENDEZVOUS cell arriving from a client connection. Its default value is "auto" for which we can turn it on or off with a consensus parameter. Default value is 0. Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-01-30dos: Add the connection DoS mitigation subsystemDavid Goulet
Defend against an address that has reached the concurrent connection count threshold. Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-01-30dos: Apply defense for circuit creation DoSDavid Goulet
If the client address was detected as malicious, apply a defense which is at this commit to return a DESTROY cell. Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-01-30dos: Detect circuit creation denial of serviceDavid Goulet
Add a function that notifies the DoS subsystem that a new CREATE cell has arrived. The statistics are updated accordingly and the IP address can also be marked as malicious if it is above threshold. At this commit, no defense is applied, just detection with a circuit creation token bucket system. Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-01-30dos: Track new and closed OR client connectionsDavid Goulet
Implement a basic connection tracking that counts the number of concurrent connections when they open and close. This commit also adds the circuit creation mitigation data structure that will be needed at later commit to keep track of the circuit rate. Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-01-30geoip: Remember client stats if DoS mitigation is enabledDavid Goulet
Make the geoip cache track client address if the DoS subsystem is enabled. Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-01-30dos: Initial code of Denial of Service mitigationDavid Goulet
This commit introduces the src/or/dos.{c|h} files that contains the code for the Denial of Service mitigation subsystem. It currently contains basic functions to initialize and free the subsystem. They are used at this commit. The torrc options and consensus parameters are defined at this commit and getters are implemented. Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-01-30Changes file for 25070teor
2018-01-30Add Link protocol version 5 to the supported protocols list in protover.cteor
Part of #25070, bugfix on 0.3.1.1-alpha.
2018-01-26If out-of-disk when saving a consensus cache entry, don't BUG.Nick Mathewson
Just warn instead. Fixes bug 24859.
2018-01-25geoip: Add a lookup function for client map entryDavid Goulet
The upcoming DoS mitigation subsytem needs to keep information on a per-IP basis which is also what the geoip clientmap does. For another subsystem to access that clientmap, this commit adds a lookup function that returns the entry. For this, the clientmap_entry_t had to be moved to the header file. Signed-off-by: David Goulet <dgoulet@torproject.org>
2018-01-23Make Tor support TLS1.3 ciphers with OpenSSL 1.1.1Nick Mathewson
Without this patch, not only will TLS1.3 not work with Tor, but OpenSSL 1.1.1 with TLS1.3 enabled won't build any connections at all: It requires that either TLS1.3 be disabled, or some TLS1.3 ciphersuites be listed. Closes ticket 24978.
2018-01-19Merge branch 'maint-0.3.0' into maint-0.3.1Nick Mathewson
"ours" merge to avoid maint-0.3.0's version of 24895.
2018-01-19Merge remote-tracking branch 'dgoulet/bug24895_031_02' into maint-0.3.1Nick Mathewson
2018-01-19Merge branch 'maint-0.2.9' into maint-0.3.0maint-0.3.0Nick Mathewson
Conflicts: src/or/rendservice.c
2018-01-19Merge remote-tracking branch 'dgoulet/bug24895_029_02' into maint-0.2.9Nick Mathewson
2018-01-19Merge branch 'bug24895_029_02' into bug24895_031_02David Goulet
2018-01-19hs: Use hs_service_max_rdv_failures consensus param, defaulting to 2Roger Dingledine
2018-01-19Merge remote-tracking branch 'tlyu-github/travis-workaround-031' into ↵Nick Mathewson
maint-0.3.1
2018-01-19Merge branch 'maint-0.3.0' into maint-0.3.1Nick Mathewson
"ours" merge to avoid 0.2.5 version of #24863 fix.
2018-01-19Merge branch 'maint-0.2.9' into maint-0.3.0Nick Mathewson
2018-01-19Merge branch 'maint-0.2.5' into maint-0.2.9Nick Mathewson
2018-01-19turn MAX_REND_FAILURES into a functionRoger Dingledine
no actual changes in behavior
2018-01-19MAX_REND_FAILURES is 1, but we would try three timesRoger Dingledine
Fix an "off by 2" error in counting rendezvous failures on the onion service side. While we thought we would stop the rendezvous attempt after one failed circuit, we were actually making three circuit attempts before giving up. Fixes bug 24895; bugfix on 0.0.6.
2018-01-18Merge branch 'bug24826_031' into maint-0.3.1Nick Mathewson
2018-01-17Work around Travis CI ptrace regressionTaylor Yu
Travis CI deployed a change that disables ptrace capabilities in container builds, which prevents LeakSanitizer on clang from working properly. Set "sudo: required" to force non-container builds for clang and work around this.
2018-01-17Work around Travis CI ptrace regressionTaylor Yu
Travis CI deployed a change that disables ptrace capabilities in container builds, which prevents LeakSanitizer on clang from working properly. Set "sudo: required" to force non-container builds for clang and work around this.
2018-01-17Add a cast to avoid a signed/unsigned comparisonNick Mathewson
2018-01-16Improve fragile-hardening performance of consensus_split_lines.Nick Mathewson
For whatever reason, in my testing, using memchr() here improves performance over strchr() by a great deal. Fixes bug 24826; bugfix on 0.3.1.1-alpha.
2018-01-15Remove false positives from channel_is_client()Roger Dingledine
Fix a set of false positives where relays would consider connections to other relays as being client-only connections (and thus e.g. deserving different link padding schemes) if those relays fell out of the consensus briefly. Now we look only at the initial handshake and whether the connection authenticated as a relay. Fixes bug 24898; bugfix on 0.3.1.1-alpha.
7apu2bq3rhoylwmucxizk54afw5jyda7pho4j5zdcqpwkufke7zdzwad.onion