mirror of
https://gitlab.torproject.org/tpo/core/tor.git
synced 2024-11-10 05:03:43 +01:00
Merge remote-tracking branch 'dgoulet/ticket25248_033_02' into maint-0.3.3
This commit is contained in:
Nick Mathewson
commit
4d8de6c6be
4
changes/ticket25248
Normal file
4
changes/ticket25248
Normal file
@ -0,0 +1,4 @@
|
||||
o Documentation (manpage, denial of service):
|
||||
- Better detail the denial of service options by listing the different
|
||||
mitigation in place. Closes ticket 25248.
|
||||
|
||||
225
doc/tor.1.txt
225
doc/tor.1.txt
@ -2406,6 +2406,136 @@ details.)
|
||||
(Default: 0)
|
||||
|
||||
|
||||
DENIAL OF SERVICE MITIGATION OPTIONS
|
||||
------------------------------------
|
||||
|
||||
Tor has three built-in mitigation options that can be individually
|
||||
enabled/disabled and fine-tuned, but by default Tor directory authorities will
|
||||
define reasonable values for relays and no explicit configuration is required
|
||||
to make use of these protections. The mitigations take place at relays,
|
||||
and are as follows:
|
||||
|
||||
1. If a single client address makes too many concurrent connections (this is
|
||||
configurable via DoSConnectionMaxConcurrentCount), hang up on further
|
||||
connections.
|
||||
+
|
||||
2. If a single client IP address (v4 or v6) makes circuits too quickly
|
||||
(default values are more than 3 per second, with an allowed burst of 90,
|
||||
see DoSCircuitCreationRate and DoSCircuitCreationBurst) while also having
|
||||
too many connections open (default is 3, see
|
||||
DoSCircuitCreationMinConnections), tor will refuse any new circuit (CREATE
|
||||
cells) for the next while (random value between 1 and 2 hours).
|
||||
+
|
||||
3. If a client asks to establish a rendezvous point to you directly (ex:
|
||||
Tor2Web client), ignore the request.
|
||||
|
||||
These defenses can be manually controlled by torrc options, but relays will
|
||||
also take guidance from consensus parameters using these same names, so there's
|
||||
no need to configure anything manually. In doubt, do not change those values.
|
||||
|
||||
The values set by the consensus, if any, can be found here:
|
||||
https://consensus-health.torproject.org/#consensusparams
|
||||
|
||||
If any of the DoS mitigations are enabled, a heartbeat message will appear in
|
||||
your log at NOTICE level which looks like:
|
||||
|
||||
DoS mitigation since startup: 429042 circuits rejected, 17 marked addresses.
|
||||
2238 connections closed. 8052 single hop clients refused.
|
||||
|
||||
The following options are useful only for a public relay. They control the
|
||||
Denial of Service mitigation subsystem described above.
|
||||
|
||||
[[DoSCircuitCreationEnabled]] **DoSCircuitCreationEnabled** **0**|**1**|**auto**::
|
||||
|
||||
Enable circuit creation DoS mitigation. If set to 1 (enabled), tor will
|
||||
cache client IPs along with statistics in order to detect circuit DoS
|
||||
attacks. If an address is positively identified, tor will activate
|
||||
defenses against the address. See the DoSCircuitCreationDefenseType option
|
||||
for more details. This is a client to relay detection only. "auto" means
|
||||
use the consensus parameter. If not defined in the consensus, the value is 0.
|
||||
(Default: auto)
|
||||
|
||||
[[DoSCircuitCreationMinConnections]] **DoSCircuitCreationMinConnections** __NUM__::
|
||||
|
||||
Minimum threshold of concurrent connections before a client address can be
|
||||
flagged as executing a circuit creation DoS. In other words, once a client
|
||||
address reaches the circuit rate and has a minimum of NUM concurrent
|
||||
connections, a detection is positive. "0" means use the consensus
|
||||
parameter. If not defined in the consensus, the value is 3.
|
||||
(Default: 0)
|
||||
|
||||
[[DoSCircuitCreationRate]] **DoSCircuitCreationRate** __NUM__::
|
||||
|
||||
The allowed circuit creation rate per second applied per client IP
|
||||
address. If this option is 0, it obeys a consensus parameter. If not
|
||||
defined in the consensus, the value is 3.
|
||||
(Default: 0)
|
||||
|
||||
[[DoSCircuitCreationBurst]] **DoSCircuitCreationBurst** __NUM__::
|
||||
|
||||
The allowed circuit creation burst per client IP address. If the circuit
|
||||
rate and the burst are reached, a client is marked as executing a circuit
|
||||
creation DoS. "0" means use the consensus parameter. If not defined in the
|
||||
consensus, the value is 90.
|
||||
(Default: 0)
|
||||
|
||||
[[DoSCircuitCreationDefenseType]] **DoSCircuitCreationDefenseType** __NUM__::
|
||||
|
||||
This is the type of defense applied to a detected client address. The
|
||||
possible values are:
|
||||
+
|
||||
1: No defense.
|
||||
+
|
||||
2: Refuse circuit creation for the DoSCircuitCreationDefenseTimePeriod period of time.
|
||||
+
|
||||
"0" means use the consensus parameter. If not defined in the consensus, the value is 2.
|
||||
(Default: 0)
|
||||
|
||||
[[DoSCircuitCreationDefenseTimePeriod]] **DoSCircuitCreationDefenseTimePeriod** __N__ **seconds**|**minutes**|**hours**::
|
||||
|
||||
The base time period in seconds that the DoS defense is activated for. The
|
||||
actual value is selected randomly for each activation from N+1 to 3/2 * N.
|
||||
"0" means use the consensus parameter. If not defined in the consensus,
|
||||
the value is 3600 seconds (1 hour).
|
||||
(Default: 0)
|
||||
|
||||
[[DoSConnectionEnabled]] **DoSConnectionEnabled** **0**|**1**|**auto**::
|
||||
|
||||
Enable the connection DoS mitigation. If set to 1 (enabled), for client
|
||||
address only, this allows tor to mitigate against large number of
|
||||
concurrent connections made by a single IP address. "auto" means use the
|
||||
consensus parameter. If not defined in the consensus, the value is 0.
|
||||
(Default: auto)
|
||||
|
||||
[[DoSConnectionMaxConcurrentCount]] **DoSConnectionMaxConcurrentCount** __NUM__::
|
||||
|
||||
The maximum threshold of concurrent connection from a client IP address.
|
||||
Above this limit, a defense selected by DoSConnectionDefenseType is
|
||||
applied. "0" means use the consensus parameter. If not defined in the
|
||||
consensus, the value is 100.
|
||||
(Default: 0)
|
||||
|
||||
[[DoSConnectionDefenseType]] **DoSConnectionDefenseType** __NUM__::
|
||||
|
||||
This is the type of defense applied to a detected client address for the
|
||||
connection mitigation. The possible values are:
|
||||
+
|
||||
1: No defense.
|
||||
+
|
||||
2: Immediately close new connections.
|
||||
+
|
||||
"0" means use the consensus parameter. If not defined in the consensus, the value is 2.
|
||||
(Default: 0)
|
||||
|
||||
[[DoSRefuseSingleHopClientRendezvous]] **DoSRefuseSingleHopClientRendezvous** **0**|**1**|**auto**::
|
||||
|
||||
Refuse establishment of rendezvous points for single hop clients. In other
|
||||
words, if a client directly connects to the relay and sends an
|
||||
ESTABLISH_RENDEZVOUS cell, it is silently dropped. "auto" means use the
|
||||
consensus parameter. If not defined in the consensus, the value is 0.
|
||||
(Default: auto)
|
||||
|
||||
|
||||
DIRECTORY AUTHORITY SERVER OPTIONS
|
||||
----------------------------------
|
||||
|
||||
@ -2752,101 +2882,6 @@ The following options are used to configure a hidden service.
|
||||
including setting SOCKSPort to "0". Can not be changed while tor is
|
||||
running. (Default: 0)
|
||||
|
||||
DENIAL OF SERVICE MITIGATION OPTIONS
|
||||
------------------------------------
|
||||
|
||||
The following options are useful only for a public relay. They control the
|
||||
Denial of Service mitigation subsystem.
|
||||
|
||||
[[DoSCircuitCreationEnabled]] **DoSCircuitCreationEnabled** **0**|**1**|**auto**::
|
||||
|
||||
Enable circuit creation DoS mitigation. If enabled, tor will cache client
|
||||
IPs along with statistics in order to detect circuit DoS attacks. If an
|
||||
address is positively identified, tor will activate defenses against the
|
||||
address. See the DoSCircuitCreationDefenseType option for more details.
|
||||
This is a client to relay detection only. "auto" means use the consensus
|
||||
parameter. If not defined in the consensus, the value is 0.
|
||||
(Default: auto)
|
||||
|
||||
[[DoSCircuitCreationMinConnections]] **DoSCircuitCreationMinConnections** __NUM__::
|
||||
|
||||
Minimum threshold of concurrent connections before a client address can be
|
||||
flagged as executing a circuit creation DoS. In other words, once a client
|
||||
address reaches the circuit rate and has a minimum of NUM concurrent
|
||||
connections, a detection is positive. "0" means use the consensus
|
||||
parameter. If not defined in the consensus, the value is 3.
|
||||
(Default: 0)
|
||||
|
||||
[[DoSCircuitCreationRate]] **DoSCircuitCreationRate** __NUM__::
|
||||
|
||||
The allowed circuit creation rate per second applied per client IP
|
||||
address. If this option is 0, it obeys a consensus parameter. If not
|
||||
defined in the consensus, the value is 3.
|
||||
(Default: 0)
|
||||
|
||||
[[DoSCircuitCreationBurst]] **DoSCircuitCreationBurst** __NUM__::
|
||||
|
||||
The allowed circuit creation burst per client IP address. If the circuit
|
||||
rate and the burst are reached, a client is marked as executing a circuit
|
||||
creation DoS. "0" means use the consensus parameter. If not defined in the
|
||||
consensus, the value is 90.
|
||||
(Default: 0)
|
||||
|
||||
[[DoSCircuitCreationDefenseType]] **DoSCircuitCreationDefenseType** __NUM__::
|
||||
|
||||
This is the type of defense applied to a detected client address. The
|
||||
possible values are:
|
||||
|
||||
1: No defense.
|
||||
2: Refuse circuit creation for the DoSCircuitCreationDefenseTimePeriod period of time.
|
||||
+
|
||||
"0" means use the consensus parameter. If not defined in the consensus,
|
||||
the value is 2.
|
||||
(Default: 0)
|
||||
|
||||
[[DoSCircuitCreationDefenseTimePeriod]] **DoSCircuitCreationDefenseTimePeriod** __N__ **seconds**|**minutes**|**hours**::
|
||||
|
||||
The base time period in seconds that the DoS defense is activated for. The
|
||||
actual value is selected randomly for each activation from N+1 to 3/2 * N.
|
||||
"0" means use the consensus parameter. If not defined in the consensus,
|
||||
the value is 3600 seconds (1 hour). (Default: 0)
|
||||
|
||||
[[DoSConnectionEnabled]] **DoSConnectionEnabled** **0**|**1**|**auto**::
|
||||
|
||||
Enable the connection DoS mitigation. For client address only, this allows
|
||||
tor to mitigate against large number of concurrent connections made by a
|
||||
single IP address. "auto" means use the consensus parameter. If not
|
||||
defined in the consensus, the value is 0.
|
||||
(Default: auto)
|
||||
|
||||
[[DoSConnectionMaxConcurrentCount]] **DoSConnectionMaxConcurrentCount** __NUM__::
|
||||
|
||||
The maximum threshold of concurrent connection from a client IP address.
|
||||
Above this limit, a defense selected by DoSConnectionDefenseType is
|
||||
applied. "0" means use the consensus parameter. If not defined in the
|
||||
consensus, the value is 100.
|
||||
(Default: 0)
|
||||
|
||||
[[DoSConnectionDefenseType]] **DoSConnectionDefenseType** __NUM__::
|
||||
|
||||
This is the type of defense applied to a detected client address for the
|
||||
connection mitigation. The possible values are:
|
||||
|
||||
1: No defense.
|
||||
2: Immediately close new connections.
|
||||
+
|
||||
"0" means use the consensus parameter. If not defined in the consensus,
|
||||
the value is 2.
|
||||
(Default: 0)
|
||||
|
||||
[[DoSRefuseSingleHopClientRendezvous]] **DoSRefuseSingleHopClientRendezvous** **0**|**1**|**auto**::
|
||||
|
||||
Refuse establishment of rendezvous points for single hop clients. In other
|
||||
words, if a client directly connects to the relay and sends an
|
||||
ESTABLISH_RENDEZVOUS cell, it is silently dropped. "auto" means use the
|
||||
consensus parameter. If not defined in the consensus, the value is 0.
|
||||
(Default: auto)
|
||||
|
||||
TESTING NETWORK OPTIONS
|
||||
-----------------------
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user