torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

DefecTor countermeasure: change server- and client-side DNS TTL clipping

Browse Source 
The server-side clipping now clamps to one of two values, both
for what to report, and how long to cache.

Additionally, we move some defines to dns.h, and give them better
names.
This commit is contained in:
Nick Mathewson
2017-01-02 14:55:39 -05:00
parent c27ae62ade
commit 609065f165
5 changed files with 33 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changes/ticket19769
+7
View File
@@ -0,0 +1,7 @@
o Major features (security):
- Change the algorithm used to decide DNS TTLs on client and server side,
to better resist DNS-based correlation attacks like the DefecTor attack
of Greschbach, Pulls, Roberts, Winter, and Feamster). Now
relays only return one of two possible DNS TTL values, and clients
are willing to believe DNS TTL values up to 3 hours long.
Closes ticket 19769.