[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-commits] [torspec/master] Proposal 258: Denial-of-service resistance for directory authorities
commit d1eb16cf35113b3ef87bb01298c6cb510f7a1604
Author: Nick Mathewson <nickm@xxxxxxxxxxxxxx>
Date: Thu Oct 29 11:56:50 2015 -0400
Proposal 258: Denial-of-service resistance for directory authorities
---
proposals/000-index.txt | 2 +
proposals/258-dirauth-dos.txt | 96 +++++++++++++++++++++++++++++++++++++++++
2 files changed, 98 insertions(+)
diff --git a/proposals/000-index.txt b/proposals/000-index.txt
index c5fabc9..0add538 100644
--- a/proposals/000-index.txt
+++ b/proposals/000-index.txt
@@ -178,6 +178,7 @@ Proposals by number:
255 Controller features to allow for load-balancing hidden services [DRAFT]
256 Key revocation for relays and authorities [OPEN]
257 Refactoring authorities and taking parts offline [DRAFT]
+258 Denial-of-service resistance for directory authorities [OPEN]
Proposals by status:
@@ -228,6 +229,7 @@ Proposals by status:
242 Better performance and usability for the MyFamily option
246 Merging Hidden Service Directories and Introduction Points
256 Key revocation for relays and authorities
+ 258 Denial-of-service resistance for directory authorities
ACCEPTED:
140 Provide diffs between consensuses
172 GETINFO controller option for circuit information
diff --git a/proposals/258-dirauth-dos.txt b/proposals/258-dirauth-dos.txt
new file mode 100644
index 0000000..28a0e9a
--- /dev/null
+++ b/proposals/258-dirauth-dos.txt
@@ -0,0 +1,96 @@
+Filename: 258-dirauth-dos.txt
+Title: Denial-of-service resistance for directory authorities
+Author: Andrea Shepard
+Created: 2015-10-27
+Status: Open
+
+1. Problem statement
+
+ The directory authorities are few in number and vital for the functioning
+ of the Tor network; threats of denial of service attacks against them have
+ occurred in the past. They should be more resistant to unreasonably large
+ connection volumes.
+
+2. Design overview
+
+ There are two possible ways a new connection to a directory authority can
+ be established, directly by a TCP connection to the DirPort, or tunneled
+ inside a Tor circuit and initiated with a begindir cell. The client can
+ originate the former as direct connections or from a Tor exit, and the
+ latter either as fully anonymized circuits or one-hop links to the
+ dirauth's ORPort.
+
+ The dirauth will try to heuristically classify incoming requests as one of
+ these four indirection types, and then in the two non-anonymized cases
+ further sort them into hash buckets on the basis of source IP. It will use
+ an exponentially-weighted moving average to measure the rate of connection
+ attempts in each bucket, and also separately limit the number of begindir
+ cells permitted on each circuit. It will periodically scan the hash tables
+ and forget counters which have fallen below a threshold to prevent memory
+ exhaustion.
+
+3. Classification of incoming connections
+
+ Clients can originate connections as one of four indirection types:
+
+ - DIRIND_ONEHOP: begindir cell on a single-hop Tor circuit
+ - DIRIND_ANONYMOUS: begindir cell on a fully anonymized Tor circuit
+ - DIRIND_DIRECT_CONN: direct TCP connection to dirport
+ - DIRIND_ANON_DIRPORT: TCP connection to dirport from an exit relay
+
+ The directory authority can always tell a dirport connection from a
+ begindir, but it must use its knowledge of the current consensus and
+ exit policies to disambiguate whether the connection is anonymized.
+
+ It should treat a begindir as DIRIND_ANONYMOUS when the previous hop
+ in the circuit it appears on is in the current consensus, and as
+ DIRIND_ONEHOP otherwise; it should treat a dirport connection as
+ DIRIND_ANON_DIRPORT if the source address appears in the consensus
+ and allows exits to the dirport in question, or as DIRIND_DIRECT_CONN
+ otherwise. In the case of relays which also act as clients, these
+ heuristics may falsely classify direct/onehop connections as anonymous,
+ but will never falsely classify anonymous connections as direct/onehop.
+
+4. Exponentially-weighted moving average counters and hash table
+
+ The directory authority implements a set of exponentially-weighted moving
+ averages to measure the rate of incoming connections in each bucket. The
+ two anonymous connection types are each a single bucket, but the two non-
+ anonymous cases get a single bucket per source IP each, stored in a hash
+ table. The directory authority must periodically scan this hash table for
+ counters which have decayed close to zero and free them to avoid permitting
+ memory exhaustion.
+
+ This introduces five new configuration parameters:
+
+ - DirDoSFilterEWMATimeConstant: the time for an EWMA counter to decay by a
+ factor of 1/e, in seconds.
+ - DirDoSFilterMaxAnonConnectRate: the threshold to trigger the DoS filter
+ on DIRIND_ANONYMOUS connections.
+ - DirDoSFilterMaxAnonDirportConnectRate: the threshold to trigger the DoS
+ filter on DIRIND_ANON_DIRPORT connections.
+ - DirDoSFilterMaxBegindirRatePerIP: the threshold per source IP to trigger
+ the DoS filter on DIRIND_ONEHOP connections.
+ - DirDoSFilterMaxDirectConnRatePerIP: the threshold per source IP to
+ trigger the DoS filter on DIRIND_DIRECT_CONN connections.
+
+ When incrementing a counter would put it over the relevant threshold, the
+ filter is said to be triggered. In this case, the directory authority does
+ not update the counter, but instead suppresses the incoming request. In
+ the DIRIND_ONEHOP and DIRIND_ANONYMOUS cases, the directory authority must
+ kill the circuit rather than merely refusing the request, to prevent
+ an unending stream of client retries on the same circuit.
+
+5. Begindir cap
+
+ Directory authorities limit the number of begindir cells permitted in the
+ lifetime of a particular circuit, separately from the EWMA counters. This
+ can only affect the DIRIND_ANONYMOUS and DIRIND_ONEHOP connetion types.
+ A sixth configuration variable, DirDoSFilterMaxBegindirPerCircuit, controls
+ this feature.
+
+6. Limitations
+
+ Widely distributed DoS attacks with many source IPs may still be able to
+ avoid raising any single DIRIND_ONEHOP or DIRIND_DIRECT_CONN counter above
+ threshold.
_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits