mirror of
https://gitlab.torproject.org/tpo/core/tor.git
synced 2024-11-10 13:13:44 +01:00
Move DNS TTL manipulation code to src/core/or
This removes a dependency from the client code on feature/relay.
This commit is contained in:
parent
dcbc45e6b2
commit
1f06f494c8
@ -432,6 +432,21 @@ warn_if_hs_unreachable(const edge_connection_t *conn, uint8_t reason)
|
||||
}
|
||||
}
|
||||
|
||||
/** Given a TTL (in seconds) from a DNS response or from a relay, determine
|
||||
* what TTL clients and relays should actually use for caching it. */
|
||||
uint32_t
|
||||
clip_dns_ttl(uint32_t ttl)
|
||||
{
|
||||
/* This logic is a defense against "DefectTor" DNS-based traffic
|
||||
* confirmation attacks, as in https://nymity.ch/tor-dns/tor-dns.pdf .
|
||||
* We only give two values: a "low" value and a "high" value.
|
||||
*/
|
||||
if (ttl < MIN_DNS_TTL)
|
||||
return MIN_DNS_TTL;
|
||||
else
|
||||
return MAX_DNS_TTL;
|
||||
}
|
||||
|
||||
/** Send a relay end cell from stream <b>conn</b> down conn's circuit, and
|
||||
* remember that we've done so. If this is not a client connection, set the
|
||||
* relay end cell's reason for closing as <b>reason</b>.
|
||||
|
@ -182,6 +182,21 @@ void connection_ap_warn_and_unmark_if_pending_circ(
|
||||
entry_connection_t *entry_conn,
|
||||
const char *where);
|
||||
|
||||
/** Lowest value for DNS ttl that a server should give or a client should
|
||||
* believe. */
|
||||
#define MIN_DNS_TTL (5*60)
|
||||
/** Highest value for DNS ttl that a server should give or a client should
|
||||
* believe. */
|
||||
#define MAX_DNS_TTL (60*60)
|
||||
/** How long do we keep DNS cache entries before purging them (regardless of
|
||||
* their TTL)? */
|
||||
#define MAX_DNS_ENTRY_AGE (3*60*60)
|
||||
/** How long do we cache/tell clients to cache DNS records when no TTL is
|
||||
* known? */
|
||||
#define DEFAULT_DNS_TTL (30*60)
|
||||
|
||||
uint32_t clip_dns_ttl(uint32_t ttl);
|
||||
|
||||
int connection_half_edge_is_valid_data(const smartlist_t *half_conns,
|
||||
streamid_t stream_id);
|
||||
int connection_half_edge_is_valid_sendme(const smartlist_t *half_conns,
|
||||
|
@ -23,7 +23,6 @@
|
||||
#include "app/config/config.h"
|
||||
#include "core/or/connection_edge.h"
|
||||
#include "feature/control/control_events.h"
|
||||
#include "feature/relay/dns.h"
|
||||
#include "feature/nodelist/nodelist.h"
|
||||
#include "feature/nodelist/routerset.h"
|
||||
|
||||
|
@ -268,22 +268,6 @@ has_dns_init_failed(void)
|
||||
return nameserver_config_failed;
|
||||
}
|
||||
|
||||
/** Helper: Given a TTL from a DNS response, determine what TTL to give the
|
||||
* OP that asked us to resolve it, and how long to cache that record
|
||||
* ourselves. */
|
||||
uint32_t
|
||||
clip_dns_ttl(uint32_t ttl)
|
||||
{
|
||||
/* This logic is a defense against "DefectTor" DNS-based traffic
|
||||
* confirmation attacks, as in https://nymity.ch/tor-dns/tor-dns.pdf .
|
||||
* We only give two values: a "low" value and a "high" value.
|
||||
*/
|
||||
if (ttl < MIN_DNS_TTL)
|
||||
return MIN_DNS_TTL;
|
||||
else
|
||||
return MAX_DNS_TTL;
|
||||
}
|
||||
|
||||
/** Helper: free storage held by an entry in the DNS cache. */
|
||||
static void
|
||||
free_cached_resolve_(cached_resolve_t *r)
|
||||
|
@ -12,22 +12,9 @@
|
||||
#ifndef TOR_DNS_H
|
||||
#define TOR_DNS_H
|
||||
|
||||
/** Lowest value for DNS ttl that a server will give. */
|
||||
#define MIN_DNS_TTL (5*60)
|
||||
/** Highest value for DNS ttl that a server will give. */
|
||||
#define MAX_DNS_TTL (60*60)
|
||||
|
||||
/** How long do we keep DNS cache entries before purging them (regardless of
|
||||
* their TTL)? */
|
||||
#define MAX_DNS_ENTRY_AGE (3*60*60)
|
||||
/** How long do we cache/tell clients to cache DNS records when no TTL is
|
||||
* known? */
|
||||
#define DEFAULT_DNS_TTL (30*60)
|
||||
|
||||
int dns_init(void);
|
||||
int has_dns_init_failed(void);
|
||||
void dns_free_all(void);
|
||||
uint32_t clip_dns_ttl(uint32_t ttl);
|
||||
int dns_reset(void);
|
||||
void connection_dns_remove(edge_connection_t *conn);
|
||||
void assert_connection_edge_not_dns_pending(edge_connection_t *conn);
|
||||
@ -74,4 +61,3 @@ launch_resolve,(cached_resolve_t *resolve));
|
||||
#endif /* defined(DNS_PRIVATE) */
|
||||
|
||||
#endif /* !defined(TOR_DNS_H) */
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user