Add a DisableV2DirectoryInfo_ option to 404 all v2 ns requests

I have no idea whether b0rken clients will DoS the network if the v2
authorities all turn this on or not.  It's experimental. See #6783 for
a description of how to test it more or less safely, and please be
careful!
This commit is contained in:
Nick Mathewson 2012-11-28 11:09:37 -05:00 committed by Roger Dingledine
parent 301faf2813
commit e4614d30e5
4 changed files with 30 additions and 0 deletions

6
changes/6783_big_hammer Normal file
View File

@ -0,0 +1,6 @@
o Major features (deprecation):
- There's now a "DisableV2DirectoryInfo_" option that prevents us
from serving any directory requests for v2 directory information.
This is for us to test disabling the old deprecated V2 directory
format, so that we can see whether doing so has any effect on
network load. Part of a fix for bug 6783.

View File

@ -213,6 +213,7 @@ static config_var_t option_vars_[] = {
V(DisableAllSwap, BOOL, "0"),
V(DisableDebuggerAttachment, BOOL, "1"),
V(DisableIOCP, BOOL, "1"),
V(DisableV2DirectoryInfo_, BOOL, "1"),
V(DynamicDHGroups, BOOL, "0"),
VPORT(DNSPort, LINELIST, NULL),
V(DNSListenAddress, LINELIST, NULL),

View File

@ -2805,6 +2805,19 @@ directory_handle_command_get(dir_connection_t *conn, const char *headers,
const char *key = url + strlen("/tor/status/");
long lifetime = NETWORKSTATUS_CACHE_LIFETIME;
if (options->DisableV2DirectoryInfo_ && !is_v3) {
static ratelim_t reject_v2_ratelim = RATELIM_INIT(1800);
char *m;
write_http_status_line(conn, 404, "Not found");
smartlist_free(dir_fps);
geoip_note_ns_response(GEOIP_REJECT_NOT_FOUND);
if ((m = rate_limit_log(&reject_v2_ratelim, approx_time()))) {
log_notice(LD_DIR, "Rejected a v2 networkstatus request.%s", m);
tor_free(m);
}
goto done;
}
if (!is_v3) {
dirserv_get_networkstatus_v2_fingerprints(dir_fps, key);
if (!strcmpstart(key, "fp/"))

View File

@ -3999,6 +3999,16 @@ typedef struct {
/** Fraction: */
double PathsNeededToBuildCircuits;
/** Do we serve v2 directory info at all? This is a temporary option, since
* we'd like to disable v2 directory serving entirely, but we need a way to
* make it temporarily disableable, in order to do fast testing and be
* able to turn it back on if it turns out to be non-workable.
*
* XXXX024 Don't actually leave this in.
*/
int DisableV2DirectoryInfo_;
} or_options_t;
/** Persistent state for an onion router, as saved to disk. */