Commit e4614d30 authored by Nick Mathewson's avatar Nick Mathewson 🦀 Committed by Roger Dingledine
Browse files

Add a DisableV2DirectoryInfo_ option to 404 all v2 ns requests 

I have no idea whether b0rken clients will DoS the network if the v2
authorities all turn this on or not.  It's experimental. See #6783 for
a description of how to test it more or less safely, and please be
careful!
parent 301faf28

changes/6783_big_hammer

0 → 100644
+6 −0
Original line number Diff line number Diff line 
  o Major features (deprecation):

    - There's now a "DisableV2DirectoryInfo_" option that prevents us

      from serving any directory requests for v2 directory information.

      This is for us to test disabling the old deprecated V2 directory

      format, so that we can see whether doing so has any effect on

      network load. Part of a fix for bug 6783.

src/or/config.c

+1 −0
Original line number Diff line number Diff line
@@ -213,6 +213,7 @@ static config_var_t option_vars_[] = { 
  V(DisableAllSwap,              BOOL,     "0"),

  V(DisableDebuggerAttachment,   BOOL,     "1"),

  V(DisableIOCP,                 BOOL,     "1"),

  V(DisableV2DirectoryInfo_,     BOOL,     "1"),

  V(DynamicDHGroups,             BOOL,     "0"),

  VPORT(DNSPort,                     LINELIST, NULL),

  V(DNSListenAddress,            LINELIST, NULL),

src/or/directory.c

+13 −0
Original line number Diff line number Diff line
@@ -2805,6 +2805,19 @@ directory_handle_command_get(dir_connection_t *conn, const char *headers, 
    const char *key = url + strlen("/tor/status/");

    long lifetime = NETWORKSTATUS_CACHE_LIFETIME;



    if (options->DisableV2DirectoryInfo_ && !is_v3) {

      static ratelim_t reject_v2_ratelim = RATELIM_INIT(1800);

      char *m;

      write_http_status_line(conn, 404, "Not found");

      smartlist_free(dir_fps);

      geoip_note_ns_response(GEOIP_REJECT_NOT_FOUND);

      if ((m = rate_limit_log(&reject_v2_ratelim, approx_time()))) {

        log_notice(LD_DIR, "Rejected a v2 networkstatus request.%s", m);

        tor_free(m);

      }

      goto done;

    }



    if (!is_v3) {

      dirserv_get_networkstatus_v2_fingerprints(dir_fps, key);

      if (!strcmpstart(key, "fp/"))

src/or/or.h

+10 −0
Original line number Diff line number Diff line
@@ -3999,6 +3999,16 @@ typedef struct { 


  /** Fraction: */

  double PathsNeededToBuildCircuits;



  /** Do we serve v2 directory info at all?  This is a temporary option, since

   * we'd like to disable v2 directory serving entirely, but we need a way to

   * make it temporarily disableable, in order to do fast testing and be

   * able to turn it back on if it turns out to be non-workable.

   *

   * XXXX024 Don't actually leave this in.

   */

  int DisableV2DirectoryInfo_;



} or_options_t;



/** Persistent state for an onion router, as saved to disk. */