dos.h 5.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140
  1. /* Copyright (c) 2018, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. /*
  4. * \file dos.h
  5. * \brief Header file for dos.c
  6. */
  7. #ifndef TOR_DOS_H
  8. #define TOR_DOS_H
  9. /* Structure that keeps stats of client connection per-IP. */
  10. typedef struct cc_client_stats_t {
  11. /* Number of allocated circuits remaining for this address. It is
  12. * decremented every time a new circuit is seen for this client address and
  13. * if the count goes to 0, we have a positive detection. */
  14. uint32_t circuit_bucket;
  15. /* When was the last time we've refilled the circuit bucket? This is used to
  16. * know if we need to refill the bucket when a new circuit is seen. It is
  17. * synchronized using approx_time(). */
  18. time_t last_circ_bucket_refill_ts;
  19. /* This client address was detected to be above the circuit creation rate
  20. * and this timestamp indicates until when it should remain marked as
  21. * detected so we can apply a defense for the address. It is synchronized
  22. * using the approx_time(). */
  23. time_t marked_until_ts;
  24. } cc_client_stats_t;
  25. /* This object is a top level object that contains everything related to the
  26. * per-IP client DoS mitigation. Because it is per-IP, it is used in the geoip
  27. * clientmap_entry_t object. */
  28. typedef struct dos_client_stats_t {
  29. /* Concurrent connection count from the specific address. 2^32 is most
  30. * likely way too big for the amount of allowed file descriptors. */
  31. uint32_t concurrent_count;
  32. /* Circuit creation statistics. This is only used if the circuit creation
  33. * subsystem has been enabled (dos_cc_enabled). */
  34. cc_client_stats_t cc_stats;
  35. } dos_client_stats_t;
  36. /* General API. */
  37. /* Stub. */
  38. struct clientmap_entry_t;
  39. void dos_init(void);
  40. void dos_free_all(void);
  41. void dos_consensus_has_changed(const networkstatus_t *ns);
  42. int dos_enabled(void);
  43. void dos_log_heartbeat(void);
  44. void dos_geoip_entry_about_to_free(const struct clientmap_entry_t *geoip_ent);
  45. void dos_new_client_conn(or_connection_t *or_conn);
  46. void dos_close_client_conn(const or_connection_t *or_conn);
  47. int dos_should_refuse_single_hop_client(void);
  48. void dos_note_refuse_single_hop_client(void);
  49. /*
  50. * Circuit creation DoS mitigation subsystemn interface.
  51. */
  52. /* DoSCircuitCreationEnabled default. Disabled by default. */
  53. #define DOS_CC_ENABLED_DEFAULT 0
  54. /* DoSCircuitCreationDefenseType maps to the dos_cc_defense_type_t enum. */
  55. #define DOS_CC_DEFENSE_TYPE_DEFAULT DOS_CC_DEFENSE_REFUSE_CELL
  56. /* DoSCircuitCreationMinConnections default */
  57. #define DOS_CC_MIN_CONCURRENT_CONN_DEFAULT 3
  58. /* DoSCircuitCreationRateTenths is 3 per seconds. */
  59. #define DOS_CC_CIRCUIT_RATE_DEFAULT 3
  60. /* DoSCircuitCreationBurst default. */
  61. #define DOS_CC_CIRCUIT_BURST_DEFAULT 90
  62. /* DoSCircuitCreationDefenseTimePeriod in seconds. */
  63. #define DOS_CC_DEFENSE_TIME_PERIOD_DEFAULT (60 * 60)
  64. /* Type of defense that we can use for the circuit creation DoS mitigation. */
  65. typedef enum dos_cc_defense_type_t {
  66. /* No defense used. */
  67. DOS_CC_DEFENSE_NONE = 1,
  68. /* Refuse any cells which means a DESTROY cell will be sent back. */
  69. DOS_CC_DEFENSE_REFUSE_CELL = 2,
  70. /* Maximum value that can be used. Useful for the boundaries of the
  71. * consensus parameter. */
  72. DOS_CC_DEFENSE_MAX = 2,
  73. } dos_cc_defense_type_t;
  74. void dos_cc_new_create_cell(channel_t *channel);
  75. dos_cc_defense_type_t dos_cc_get_defense_type(channel_t *chan);
  76. /*
  77. * Concurrent connection DoS mitigation interface.
  78. */
  79. /* DoSConnectionEnabled default. Disabled by default. */
  80. #define DOS_CONN_ENABLED_DEFAULT 0
  81. /* DoSConnectionMaxConcurrentCount default. */
  82. #define DOS_CONN_MAX_CONCURRENT_COUNT_DEFAULT 100
  83. /* DoSConnectionDefenseType maps to the dos_conn_defense_type_t enum. */
  84. #define DOS_CONN_DEFENSE_TYPE_DEFAULT DOS_CONN_DEFENSE_CLOSE
  85. /* Type of defense that we can use for the concurrent connection DoS
  86. * mitigation. */
  87. typedef enum dos_conn_defense_type_t {
  88. /* No defense used. */
  89. DOS_CONN_DEFENSE_NONE = 1,
  90. /* Close immediately the connection meaning refuse it. */
  91. DOS_CONN_DEFENSE_CLOSE = 2,
  92. /* Maximum value that can be used. Useful for the boundaries of the
  93. * consensus parameter. */
  94. DOS_CONN_DEFENSE_MAX = 2,
  95. } dos_conn_defense_type_t;
  96. dos_conn_defense_type_t dos_conn_addr_get_defense_type(const tor_addr_t *addr);
  97. #ifdef DOS_PRIVATE
  98. STATIC uint32_t get_param_conn_max_concurrent_count(
  99. const networkstatus_t *ns);
  100. STATIC uint32_t get_param_cc_circuit_burst(const networkstatus_t *ns);
  101. STATIC uint32_t get_param_cc_min_concurrent_connection(
  102. const networkstatus_t *ns);
  103. STATIC uint64_t get_circuit_rate_per_second(void);
  104. STATIC void cc_stats_refill_bucket(cc_client_stats_t *stats,
  105. const tor_addr_t *addr);
  106. MOCK_DECL(STATIC unsigned int, get_param_cc_enabled,
  107. (const networkstatus_t *ns));
  108. MOCK_DECL(STATIC unsigned int, get_param_conn_enabled,
  109. (const networkstatus_t *ns));
  110. #endif /* TOR_DOS_PRIVATE */
  111. #endif /* TOR_DOS_H */