{"push_id":2336585065,"size":41,"distinct_size":0,"ref":"refs/heads/maint-0.2.9","head":"cb92d47deca15c44dd52cad6fc326520648c632e","before":"2b99350ca4c905db1bd4f1aecc630b4f55933e96","commits":[{"sha":"93b826faaa7cca351c68256ce60a7f7e6c5fda5b","author":{"name":"David Goulet","email":"b2d63b45340107d8b2f64e7518c9e01a6d63a811@torproject.org"},"message":"geoip: Add a lookup function for client map entry\n\nThe upcoming DoS mitigation subsytem needs to keep information on a per-IP\nbasis which is also what the geoip clientmap does.\n\nFor another subsystem to access that clientmap, this commit adds a lookup\nfunction that returns the entry. For this, the clientmap_entry_t had to be\nmoved to the header file.\n\nSigned-off-by: David Goulet <dgoulet@torproject.org>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/93b826faaa7cca351c68256ce60a7f7e6c5fda5b"},{"sha":"64149353dda6336488e7d011534a7132b3f01acc","author":{"name":"David Goulet","email":"b2d63b45340107d8b2f64e7518c9e01a6d63a811@torproject.org"},"message":"dos: Initial code of Denial of Service mitigation\n\nThis commit introduces the src/or/dos.{c|h} files that contains the code for\nthe Denial of Service mitigation subsystem. It currently contains basic\nfunctions to initialize and free the subsystem. They are used at this commit.\n\nThe torrc options and consensus parameters are defined at this commit and\ngetters are implemented.\n\nSigned-off-by: David Goulet <dgoulet@torproject.org>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/64149353dda6336488e7d011534a7132b3f01acc"},{"sha":"51fda85c23e5ff2cabbc66ea19b006c4cb04b1e2","author":{"name":"David Goulet","email":"b2d63b45340107d8b2f64e7518c9e01a6d63a811@torproject.org"},"message":"geoip: Remember client stats if DoS mitigation is enabled\n\nMake the geoip cache track client address if the DoS subsystem is enabled.\n\nSigned-off-by: David Goulet <dgoulet@torproject.org>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/51fda85c23e5ff2cabbc66ea19b006c4cb04b1e2"},{"sha":"c05272783d0164363023ddd4b3ee93c2e12c8911","author":{"name":"David Goulet","email":"b2d63b45340107d8b2f64e7518c9e01a6d63a811@torproject.org"},"message":"dos: Track new and closed OR client connections\n\nImplement a basic connection tracking that counts the number of concurrent\nconnections when they open and close.\n\nThis commit also adds the circuit creation mitigation data structure that will\nbe needed at later commit to keep track of the circuit rate.\n\nSigned-off-by: David Goulet <dgoulet@torproject.org>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/c05272783d0164363023ddd4b3ee93c2e12c8911"},{"sha":"97abb3543b858afd27ed857903814175c1dfbf12","author":{"name":"David Goulet","email":"b2d63b45340107d8b2f64e7518c9e01a6d63a811@torproject.org"},"message":"dos: Detect circuit creation denial of service\n\nAdd a function that notifies the DoS subsystem that a new CREATE cell has\narrived. The statistics are updated accordingly and the IP address can also be\nmarked as malicious if it is above threshold.\n\nAt this commit, no defense is applied, just detection with a circuit creation\ntoken bucket system.\n\nSigned-off-by: David Goulet <dgoulet@torproject.org>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/97abb3543b858afd27ed857903814175c1dfbf12"},{"sha":"1bfc91a029839f36e04c8204d1bccaa04a5c2afd","author":{"name":"David Goulet","email":"b2d63b45340107d8b2f64e7518c9e01a6d63a811@torproject.org"},"message":"dos: Apply defense for circuit creation DoS\n\nIf the client address was detected as malicious, apply a defense which is at\nthis commit to return a DESTROY cell.\n\nSigned-off-by: David Goulet <dgoulet@torproject.org>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/1bfc91a029839f36e04c8204d1bccaa04a5c2afd"},{"sha":"acf7ea77d8d76830924a14145afbcf3c95a06b0e","author":{"name":"David Goulet","email":"b2d63b45340107d8b2f64e7518c9e01a6d63a811@torproject.org"},"message":"dos: Add the connection DoS mitigation subsystem\n\nDefend against an address that has reached the concurrent connection count\nthreshold.\n\nSigned-off-by: David Goulet <dgoulet@torproject.org>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/acf7ea77d8d76830924a14145afbcf3c95a06b0e"},{"sha":"36a0ae151f8f85c76b4bd91a8fc2871dd88b6005","author":{"name":"David Goulet","email":"b2d63b45340107d8b2f64e7518c9e01a6d63a811@torproject.org"},"message":"dos: Add the DoSRefuseSingleHopClientRendezvous option\n\nThis option refuses any ESTABLISH_RENDEZVOUS cell arriving from a client\nconnection. Its default value is \"auto\" for which we can turn it on or off\nwith a consensus parameter. Default value is 0.\n\nSigned-off-by: David Goulet <dgoulet@torproject.org>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/36a0ae151f8f85c76b4bd91a8fc2871dd88b6005"},{"sha":"14a8b87852887f8c20a424ff32a2b6746105dd6c","author":{"name":"David Goulet","email":"b2d63b45340107d8b2f64e7518c9e01a6d63a811@torproject.org"},"message":"dos: Add a heartbeat log\n\nSigned-off-by: David Goulet <dgoulet@torproject.org>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/14a8b87852887f8c20a424ff32a2b6746105dd6c"},{"sha":"82de4ea900c5d3513214b127421890595343bfaa","author":{"name":"David Goulet","email":"b2d63b45340107d8b2f64e7518c9e01a6d63a811@torproject.org"},"message":"dos: Clear connection tracked flag if geoip entry is removed\n\nImagine this scenario. We had 10 connections over the 24h lifetime of a geoip\ncache entry. The lifetime of the entry has been reached so it is about to get\nfreed but 2 connections remain for it. After the free, a third connection\ncomes in thus making us create a new geoip entry for that address matching the\n2 previous ones that are still alive. If they end up being closed, we'll have\na concurrent count desynch from what the reality is.\n\nTo mitigate this probably very rare scenario in practice, when we free a geoip\nentry and it has a concurrent count above 0, we'll go over all connections\nmatching the address and clear out the tracked flag. So once they are closed,\nwe don't try to decrement the count.\n\nSigned-off-by: David Goulet <dgoulet@torproject.org>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/82de4ea900c5d3513214b127421890595343bfaa"},{"sha":"c3c2b55decc80028728780422fe2766ec6517246","author":{"name":"George Kadianakis","email":"d7676a97e237f3d9ff3e93c6cbff3a4fceaec51f@riseup.net"},"message":"test: Add unit tests for the DoS subsystem\n\nSigned-off-by: David Goulet <dgoulet@torproject.org>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/c3c2b55decc80028728780422fe2766ec6517246"},{"sha":"a3714268f659998dc879ed723852440cd8be1b04","author":{"name":"David Goulet","email":"b2d63b45340107d8b2f64e7518c9e01a6d63a811@torproject.org"},"message":"dos: Man page entry for DoS mitigation\n\nSigned-off-by: David Goulet <dgoulet@torproject.org>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/a3714268f659998dc879ed723852440cd8be1b04"},{"sha":"e58a4fc6cfcdeafc2ebfb61fd3cf6d163ce2436c","author":{"name":"David Goulet","email":"b2d63b45340107d8b2f64e7518c9e01a6d63a811@torproject.org"},"message":"dos: Make circuit rate limit per second, not tenths anymore\n\nBecause this touches too many commits at once, it is made into one single\ncommit.\n\nRemove the use of \"tenths\" for the circuit rate to simplify things. We can\nonly refill the buckets at best once every second because of the use of\napprox_time() and our token system is set to be 1 token = 1 circuit so make\nthe rate a flat integer of circuit per second.\n\nSigned-off-by: David Goulet <dgoulet@torproject.org>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/e58a4fc6cfcdeafc2ebfb61fd3cf6d163ce2436c"},{"sha":"9aca7d47306222f2870ec16a7291a8215d6c3316","author":{"name":"David Goulet","email":"b2d63b45340107d8b2f64e7518c9e01a6d63a811@torproject.org"},"message":"dos: Add changes file for ticket 24902\n\nSigned-off-by: David Goulet <dgoulet@torproject.org>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/9aca7d47306222f2870ec16a7291a8215d6c3316"},{"sha":"b45ae1b00237f0209c4ccce777de59581fda5e39","author":{"name":"teor","email":"73d8ed7d3f4749ab67f2538db81338b468a3e158@gmail.com"},"message":"test: Remove a redundant round from test_dos_bucket_refill\n\nThis round is left over from the tenths of a second code.\n\nPart of #25094.","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/b45ae1b00237f0209c4ccce777de59581fda5e39"},{"sha":"a09d5f5735abe2e1d16cf0ee9389ae096d5e7ef1","author":{"name":"teor","email":"73d8ed7d3f4749ab67f2538db81338b468a3e158@gmail.com"},"message":"dos: Make sure cc_stats_refill_bucket can't overflow while calculating\n\nDebug log the elapsed time in cc_stats_refill_bucket\n\nPart of #25094.\n\nSigned-off-by: David Goulet <dgoulet@torproject.org>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/a09d5f5735abe2e1d16cf0ee9389ae096d5e7ef1"},{"sha":"1f4a73133cf864774c017e2c50b347727519c18f","author":{"name":"teor","email":"73d8ed7d3f4749ab67f2538db81338b468a3e158@gmail.com"},"message":"test: Add unit tests for overflows and underflows in cc_stats_refill_bucket\n\nCloses #25094.\n\nSigned-off-by: David Goulet <dgoulet@torproject.org>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/1f4a73133cf864774c017e2c50b347727519c18f"},{"sha":"33d9889a2bdd611bcc255c68c43d60b8919ab663","author":{"name":"Fernando Fernandez Mancera","email":"f35d7c41675ef875fa07ba547d136d9af7982719@riseup.net"},"message":"channel_tls_get_remote_addr_method now returns real_addr.\n\nThe accurate address of a connection is real_addr, not the addr member.\nchannel_tls_get_remote_addr_method() now returns real_addr instead.\n\nFixes #24952; bugfix on 707c1e2 in 0.2.4.11-alpha.\n\nSigned-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/33d9889a2bdd611bcc255c68c43d60b8919ab663"},{"sha":"51839f47650463f59bd2cc84da05d5bc535d699d","author":{"name":"David Goulet","email":"b2d63b45340107d8b2f64e7518c9e01a6d63a811@torproject.org"},"message":"geoip: Hook the client history cache into the OOM handler\n\nIf the cache is using 20% of our maximum allowed memory, clean 10% of it. Same\nbehavior as the HS descriptor cache.\n\nCloses #25122\n\nSigned-off-by: David Goulet <dgoulet@torproject.org>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/51839f47650463f59bd2cc84da05d5bc535d699d"},{"sha":"4d812e29b9b1ec88fe268c150a826466b23a8762","author":{"name":"David Goulet","email":"b2d63b45340107d8b2f64e7518c9e01a6d63a811@torproject.org"},"message":"geoip: Increment and decrement functions for the geoip client cache\n\nThese functions protect againts over and underflow. They BUG() in case we\noverflow the counter.\n\nSigned-off-by: David Goulet <dgoulet@torproject.org>","distinct":false,"url":"https://api.github.com/repos/tlyu/tor/commits/4d812e29b9b1ec88fe268c150a826466b23a8762"}]}
{"actor":{"display_login":"tlyu"}}