Ticket15516 042 02 #1061

dgoulet-tor · 2019-05-30T13:05:59Z

No description provided.

coveralls · 2019-05-30T13:24:52Z

Pull Request Test Coverage Report for Build 5518

47 of 61 (77.05%) changed or added relevant lines in 6 files are covered.
656 unchanged lines in 9 files lost coverage.
Overall coverage increased (+0.2%) to 62.821%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
src/feature/hs/hs_dos.c	37	39	94.87%
src/feature/rend/rendmid.c	1	3	33.33%
src/feature/hs/hs_intropoint.c	3	6	50.0%
src/feature/hs/hs_circuitmap.c	4	11	36.36%

Files with Coverage Reduction	New Missed Lines	%
src/feature/control/control_proto.c	19	44.55%
src/lib/net/resolve.c	24	82.27%
src/app/config/config.c	24	71.96%
src/feature/relay/router.c	41	52.1%
src/lib/net/address.c	49	91.24%
src/core/or/circuitpadding.c	55	92.73%
src/feature/control/control_auth.c	63	12.09%
src/feature/client/entrynodes.c	74	86.25%
src/feature/control/control_cmd.c	307	15.44%

Totals
Change from base Build 5351:	0.2%
Covered Lines:	47138
Relevant Lines:	75036

💛 - Coveralls

src/feature/hs/hs_dos.c

src/feature/hs/hs_dos.h

src/feature/hs/hs_intropoint.c

src/feature/rend/rendmid.c

This commit add the hs_dos.{c|h} file that has the purpose of having the anti-DoS code for onion services. At this commit, it only has one which is a function that decides if an INTRODUCE2 can be sent on the given introduction service circuit (S<->IP) using a simple token bucket. The rate per second is 25 and allowed burst to 200. Basic defenses on #15516. Signed-off-by: David Goulet <dgoulet@torproject.org>

Currently test the only available function which is hs_dos_can_send_intro2() within the HS anti-DoS subsystem. Closes #15516 Signed-off-by: David Goulet <dgoulet@torproject.org>

Part of #15516 Signed-off-by: David Goulet <dgoulet@torproject.org>

src/feature/hs/hs_dos.c

teor2345 · 2019-06-26T11:03:13Z

src/feature/hs/hs_intropoint.c

@@ -202,6 +203,9 @@ handle_verified_establish_intro_cell(or_circuit_t *circ,
  hs_circuitmap_register_intro_circ_v3_relay_side(circ, &auth_key);
  /* Repurpose this circuit into an intro circuit. */
  circuit_change_purpose(TO_CIRCUIT(circ), CIRCUIT_PURPOSE_INTRO_POINT);
+  /* Initialize the INTRODUCE2 token bucket for the rate limiting. */
+  token_bucket_ctr_init(&circ->introduce2_bucket, hs_dos_get_intro2_rate(),
+                        hs_dos_get_intro2_burst(), (uint32_t) approx_time());


Introduction circuits can last for 18-24 hours, so it's a bit surprising that we copy the DoS values at the ESTABLISH_INTRO, and then don't change them, even if the torrc config or consensus parameters change.

That means operators will need to restart their intro point or onion service (or wait 24 hours) to overcome a DoS.

GREAT catch.

So this patch for now only has consensus parameters support where torrc options (for the ESTABLISH_INTRO parameter comes with another ticket, prop305) aren't implemented yet.

This fix required a bit more code that is a function in the HS circuitmap module to "get all intro circuits" so we can go over them and adjust the token bucket parameters.

New commit takes care of this: d5e28d0

LGTM, but I will let teor take a look as well. Not resolving yet.

Ok, looks good to me.

Let's make sure we remember to update all the circuits when the torrc options change :-)

Following prop305 values. Signed-off-by: David Goulet <dgoulet@torproject.org>

In case the consensus parameters for the rate/burst changes, we need to update all already established introduction circuits to the newest value. This commit introduces a "get all intro circ" function from the HS circuitmap (v2 and v3) so it can be used by the HS DoS module to go over all circuits and adjust the INTRODUCE2 token bucket parameters. Signed-off-by: David Goulet <dgoulet@torproject.org>

Signed-off-by: David Goulet <dgoulet@torproject.org>