dirauth_options.inc (6129B)
1 /* Copyright (c) 2001 Matej Pfajfar. 2 * Copyright (c) 2001-2004, Roger Dingledine. 3 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. 4 * Copyright (c) 2007-2019, The Tor Project, Inc. */ 5 /* See LICENSE for licensing information */ 6 7 /** 8 * @file dirauth_options.inc 9 * @brief Declare configuration options for the crypto_ops module. 10 **/ 11 12 /** Holds configuration about our directory authority options. */ 13 BEGIN_CONF_STRUCT(dirauth_options_t) 14 15 /** If non-zero, always vote the Fast flag for any relay advertising 16 * this amount of capacity or more. */ 17 CONF_VAR(AuthDirFastGuarantee, MEMUNIT, 0, "100 KB") 18 19 /** If non-zero, this advertised capacity or more is always sufficient 20 * to satisfy the bandwidth requirement for the Guard flag. */ 21 CONF_VAR(AuthDirGuardBWGuarantee, MEMUNIT, 0, "2 MB") 22 23 /** Boolean: are we on IPv6? */ 24 CONF_VAR(AuthDirHasIPv6Connectivity, BOOL, 0, "0") 25 26 /** True iff we should list bad exits, and vote for all other exits as 27 * good. */ 28 CONF_VAR(AuthDirListBadExits, BOOL, 0, "0") 29 30 /** True iff we should list middle-only relays, and vote for all other 31 * relays as possibly suitable for other positions. */ 32 CONF_VAR(AuthDirListMiddleOnly, BOOL, 0, "0") 33 34 /** Do not permit more than this number of servers per IP address. */ 35 CONF_VAR(AuthDirMaxServersPerAddr, POSINT, 0, "2") 36 37 /** Boolean: Do we enforce key-pinning? */ 38 CONF_VAR(AuthDirPinKeys, BOOL, 0, "1") 39 40 /** Bool (default: 1): Switch for the shared random protocol. Only 41 * relevant to a directory authority. If off, the authority won't 42 * participate in the protocol. If on (default), a flag is added to the 43 * vote indicating participation. */ 44 CONF_VAR(AuthDirSharedRandomness, BOOL, 0, "1") 45 46 /** Bool (default: 1): When testing routerinfos as a directory authority, 47 * do we enforce Ed25519 identity match? */ 48 /* NOTE: remove this option someday. */ 49 CONF_VAR(AuthDirTestEd25519LinkKeys, BOOL, 0, "1") 50 51 /** 52 * Bool (default 1): As an authority, should we launch tests for 53 * reachability, and use those results to vote on "Running"? If 0, 54 * we assume that every relay is Running. 55 **/ 56 CONF_VAR(AuthDirTestReachability, BOOL, 0, "1") 57 58 /** Authority only: key=value pairs that we add to our networkstatus 59 * consensus vote on the 'params' line. */ 60 CONF_VAR(ConsensusParams, LINELIST, 0, NULL) 61 62 /** Authority only: minimum number of measured bandwidths we must see 63 * before we only believe measured bandwidths to assign flags. */ 64 CONF_VAR(MinMeasuredBWsForAuthToIgnoreAdvertised, INT, 0, "500") 65 66 /** As directory authority, accept hidden service directories after what 67 * time? */ 68 CONF_VAR(MinUptimeHidServDirectoryV2, INTERVAL, 0, "96 hours") 69 70 /** Which versions of tor should we tell users to run? */ 71 CONF_VAR(RecommendedVersions, LINELIST, 0, NULL) 72 73 /** Which versions of tor should we tell users to run on clients? */ 74 CONF_VAR(RecommendedClientVersions, LINELIST, 0, NULL) 75 76 /** Which versions of tor should we tell users to run on relays? */ 77 CONF_VAR(RecommendedServerVersions, LINELIST, 0, NULL) 78 79 /** Which minimal version of tor do we accept relay descriptors from? */ 80 CONF_VAR(MinimalAcceptedServerVersion, STRING, 0, "0.4.8.0-alpha-dev") 81 82 /** Relays which should be voted Guard regardless of uptime and bandwidth. */ 83 CONF_VAR(AuthDirVoteGuard, ROUTERSET, 0, NULL) 84 85 /** If a relay's uptime is at least this value, then it is always considered 86 * stable, regardless of the rest of the network. This way we resist attacks 87 * where an attacker doubles the size of the network using allegedly 88 * high-uptime nodes, displacing all the current guards. */ 89 CONF_VAR(AuthDirVoteStableGuaranteeMinUptime, INTERVAL, 0, "30 days") 90 91 /** If a relay's MTBF is at least this value, then it is always stable. See 92 * above. (Corresponds to about 7 days for current decay rates.) */ 93 CONF_VAR(AuthDirVoteStableGuaranteeMTBF, INTERVAL, 0, "5 days") 94 95 /** A relay with at least this much weighted time known can be considered 96 * familiar enough to be a guard. (Corresponds to about 20 days for current 97 * decay rates.) */ 98 CONF_VAR(AuthDirVoteGuardGuaranteeTimeKnown, INTERVAL, 0, "8 days") 99 100 /** A relay with sufficient WFU is around enough to be a guard. */ 101 CONF_VAR(AuthDirVoteGuardGuaranteeWFU, DOUBLE, 0, "0.98") 102 103 /** The Guard flag bandwidth performance threshold fraction that is the 104 * fraction representing who gets the Guard flag out of all measured 105 * bandwidth. */ 106 CONF_VAR(AuthDirVoteGuardBwThresholdFraction, DOUBLE, 0, "0.75") 107 108 /** If an authority has been around for less than this amount of time, it 109 * does not believe its reachability information is accurate. Only 110 * altered on testing networks. */ 111 CONF_VAR(TestingAuthDirTimeToLearnReachability, INTERVAL, 0, "30 minutes") 112 113 /** Relays in a testing network which should be voted Exit 114 * regardless of exit policy. */ 115 CONF_VAR(TestingDirAuthVoteExit, ROUTERSET, 0, NULL) 116 CONF_VAR(TestingDirAuthVoteExitIsStrict, BOOL, 0, "0") 117 118 /** Relays in a testing network which should be voted Guard 119 * regardless of uptime and bandwidth. */ 120 CONF_VAR(TestingDirAuthVoteGuard, ROUTERSET, 0, NULL) 121 CONF_VAR(TestingDirAuthVoteGuardIsStrict, BOOL, 0, "0") 122 123 /** Relays in a testing network which should be voted HSDir 124 * regardless of uptime and DirPort. */ 125 CONF_VAR(TestingDirAuthVoteHSDir, ROUTERSET, 0, NULL) 126 CONF_VAR(TestingDirAuthVoteHSDirIsStrict, BOOL, 0, "0") 127 128 /** Minimum value for the Exit flag threshold on testing networks. */ 129 CONF_VAR(TestingMinExitFlagThreshold, MEMUNIT, 0, "0") 130 131 /** Minimum value for the Fast flag threshold on testing networks. */ 132 CONF_VAR(TestingMinFastFlagThreshold, MEMUNIT, 0, "0") 133 134 /** Boolean: is this an authoritative directory that's willing to recommend 135 * versions? */ 136 CONF_VAR(VersioningAuthoritativeDirectory, BOOL, 0, "0") 137 138 /** Boolean: Under bandwidth pressure, if set to 1, the authority will always 139 * answer directory requests from relays but will start sending 503 error code 140 * for the other connections. If set to 0, all connections are considered the 141 * same and the authority will try to answer them all regardless of bandwidth 142 * pressure or not. */ 143 CONF_VAR(AuthDirRejectRequestsUnderLoad, BOOL, 0, "1") 144 145 END_CONF_STRUCT(dirauth_options_t)