Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable DoS defense at the intropoint level. #1129

Closed
wants to merge 1 commit into from

Conversation

boldsuck
Copy link
Contributor

The rate and burst parameter (see below) will be sent to the intro point which will then use them to apply rate limiting for introduction request to this service. The introduction point honors the directory consensus parameters except if this is specifically set by the service operator using this option. (Defaults:)

HiddenServiceEnableIntroDoSBurstPerSec 200
HiddenServiceEnableIntroDoSRatePerSec 25

The rate and burst parameter (see below) will be sent to the intro point which will then use them to apply rate limiting for introduction request to this service.
The introduction point honors the directory consensus parameters except if this is specifically set by the service operator using this option. (Defaults:)
HiddenServiceEnableIntroDoSBurstPerSec 200
HiddenServiceEnableIntroDoSRatePerSec 25
@boldsuck boldsuck requested a review from woodser as a code owner July 11, 2024 14:29
@woodser
Copy link
Contributor

woodser commented Jul 11, 2024

Did you confirm the setting is being applied? I don't see any difference anywhere with/without these settings, so don't know how to confirm it's applied.

HiddenServicePoWDefensesEnabled 1
HiddenServiceEnableIntroDoSDefense 1

@boldsuck
Copy link
Contributor Author

Problem PoW:
The service starts with a default suggested-effort value of 0, which keeps the PoW defenses dormant until we notice signs of queue overload. That's why I activated IntroDoSDefense to then see in Tor metrics whether these settings work.
I see my seed node onion address with curl http://127.0.0.1:9035/metrics

# HELP tor_hs_rdv_pow_pqueue_count Number of requests waiting in the proof of work priority queue
# TYPE tor_hs_rdv_pow_pqueue_count gauge
tor_hs_rdv_pow_pqueue_count{onion="my seed node onion address"} 0
# HELP tor_hs_pow_suggested_effort Suggested effort for requests with a proof of work client puzzle
# TYPE tor_hs_pow_suggested_effort gauge
tor_hs_pow_suggested_effort{onion="my seed node onion address"} 0

I'll let the seednode run for 24-48 hours in the reto mainnet. If PoW works, the values ​​should change. And also instruct the other Reto seednode operators to activate the metrics port. #1122 (comment)

@boldsuck
Copy link
Contributor Author

This is nonsense for the "relay" app, which is a service to relay client notifications to users' mobile devices. PoW should also be removed if this connection is ever used.
I'm closing the PR.

@boldsuck boldsuck closed this Jul 18, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants