Move DNS TTL manipulation code to src/core/or

This removes a dependency from the client code on feature/relay.
This commit is contained in:
Nick Mathewson 2020-02-18 12:08:29 -05:00
parent dcbc45e6b2
commit 1f06f494c8
5 changed files with 30 additions and 31 deletions

View File

@ -432,6 +432,21 @@ warn_if_hs_unreachable(const edge_connection_t *conn, uint8_t reason)
} }
} }
/** Given a TTL (in seconds) from a DNS response or from a relay, determine
* what TTL clients and relays should actually use for caching it. */
uint32_t
clip_dns_ttl(uint32_t ttl)
{
/* This logic is a defense against "DefectTor" DNS-based traffic
* confirmation attacks, as in https://nymity.ch/tor-dns/tor-dns.pdf .
* We only give two values: a "low" value and a "high" value.
*/
if (ttl < MIN_DNS_TTL)
return MIN_DNS_TTL;
else
return MAX_DNS_TTL;
}
/** Send a relay end cell from stream <b>conn</b> down conn's circuit, and /** Send a relay end cell from stream <b>conn</b> down conn's circuit, and
* remember that we've done so. If this is not a client connection, set the * remember that we've done so. If this is not a client connection, set the
* relay end cell's reason for closing as <b>reason</b>. * relay end cell's reason for closing as <b>reason</b>.

View File

@ -182,6 +182,21 @@ void connection_ap_warn_and_unmark_if_pending_circ(
entry_connection_t *entry_conn, entry_connection_t *entry_conn,
const char *where); const char *where);
/** Lowest value for DNS ttl that a server should give or a client should
* believe. */
#define MIN_DNS_TTL (5*60)
/** Highest value for DNS ttl that a server should give or a client should
* believe. */
#define MAX_DNS_TTL (60*60)
/** How long do we keep DNS cache entries before purging them (regardless of
* their TTL)? */
#define MAX_DNS_ENTRY_AGE (3*60*60)
/** How long do we cache/tell clients to cache DNS records when no TTL is
* known? */
#define DEFAULT_DNS_TTL (30*60)
uint32_t clip_dns_ttl(uint32_t ttl);
int connection_half_edge_is_valid_data(const smartlist_t *half_conns, int connection_half_edge_is_valid_data(const smartlist_t *half_conns,
streamid_t stream_id); streamid_t stream_id);
int connection_half_edge_is_valid_sendme(const smartlist_t *half_conns, int connection_half_edge_is_valid_sendme(const smartlist_t *half_conns,

View File

@ -23,7 +23,6 @@
#include "app/config/config.h" #include "app/config/config.h"
#include "core/or/connection_edge.h" #include "core/or/connection_edge.h"
#include "feature/control/control_events.h" #include "feature/control/control_events.h"
#include "feature/relay/dns.h"
#include "feature/nodelist/nodelist.h" #include "feature/nodelist/nodelist.h"
#include "feature/nodelist/routerset.h" #include "feature/nodelist/routerset.h"

View File

@ -268,22 +268,6 @@ has_dns_init_failed(void)
return nameserver_config_failed; return nameserver_config_failed;
} }
/** Helper: Given a TTL from a DNS response, determine what TTL to give the
* OP that asked us to resolve it, and how long to cache that record
* ourselves. */
uint32_t
clip_dns_ttl(uint32_t ttl)
{
/* This logic is a defense against "DefectTor" DNS-based traffic
* confirmation attacks, as in https://nymity.ch/tor-dns/tor-dns.pdf .
* We only give two values: a "low" value and a "high" value.
*/
if (ttl < MIN_DNS_TTL)
return MIN_DNS_TTL;
else
return MAX_DNS_TTL;
}
/** Helper: free storage held by an entry in the DNS cache. */ /** Helper: free storage held by an entry in the DNS cache. */
static void static void
free_cached_resolve_(cached_resolve_t *r) free_cached_resolve_(cached_resolve_t *r)

View File

@ -12,22 +12,9 @@
#ifndef TOR_DNS_H #ifndef TOR_DNS_H
#define TOR_DNS_H #define TOR_DNS_H
/** Lowest value for DNS ttl that a server will give. */
#define MIN_DNS_TTL (5*60)
/** Highest value for DNS ttl that a server will give. */
#define MAX_DNS_TTL (60*60)
/** How long do we keep DNS cache entries before purging them (regardless of
* their TTL)? */
#define MAX_DNS_ENTRY_AGE (3*60*60)
/** How long do we cache/tell clients to cache DNS records when no TTL is
* known? */
#define DEFAULT_DNS_TTL (30*60)
int dns_init(void); int dns_init(void);
int has_dns_init_failed(void); int has_dns_init_failed(void);
void dns_free_all(void); void dns_free_all(void);
uint32_t clip_dns_ttl(uint32_t ttl);
int dns_reset(void); int dns_reset(void);
void connection_dns_remove(edge_connection_t *conn); void connection_dns_remove(edge_connection_t *conn);
void assert_connection_edge_not_dns_pending(edge_connection_t *conn); void assert_connection_edge_not_dns_pending(edge_connection_t *conn);
@ -74,4 +61,3 @@ launch_resolve,(cached_resolve_t *resolve));
#endif /* defined(DNS_PRIVATE) */ #endif /* defined(DNS_PRIVATE) */
#endif /* !defined(TOR_DNS_H) */ #endif /* !defined(TOR_DNS_H) */