Re: [tor-relays] Reapply exit policy on reload

Subject: Re: [tor-relays] Reapply exit policy on reload

From: George Hartley via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>

Date: Sat, 10 Aug 2024 03:25:51 +0000

Cc: George Hartley <hartley_george@xxxxxxxxx>

Delivery-date: Sat, 10 Aug 2024 11:16:36 -0400

Dkim-signature: v=1; a=rsa-sha256; c=simple/simple; d=lists.torproject.org; s=2022-eugeni; t=1723302990; bh=751cmWyrxw3rRzVbOnD342BRGdpRIGjlRqZogGXsR9k=; h=Date:To:In-Reply-To:References:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=mgVyJnsOZwekMlvGGqkgo3JnrNpM0+Wumed/cade4B6ekLQ138YUddOVE5zHS/wb1 MOWLJq+Y4wzZ1rOcaYj8lS+xhzfXfWxsberIS5sNMrTddvP8kzuXyGkBMTwkaS/bOb iN5yR5+1UjIKZqavAy/xqacSzkPmEqRr9IASz8cbsdkm+phtvjpDYNQeS5eYLvIUXc 8PC3373fR6pRXrCy5HtSa7KhzJ9bKgGRYUG0OnEx1ctVs9ac3r+IDcd44/0eFxTLC/ VPzVdhJojB9QEy81PRD5XmSW3smscgCiLfyAFmzp2jfP4TLTCQPQlauFcdOZXfAfyH 0+RXMchfqnWrA==

Feedback-id: 68993610:user:proton

In-reply-to: <2033009.atdPhlSkOF@t520>

List-archive: <http://lists.torproject.org/pipermail/tor-relays/>

List-help: <mailto:tor-relays-request@lists.torproject.org?subject=help>

List-id: "support and questions about running Tor relays \(exit, non-exit, bridge\)" <tor-relays.lists.torproject.org>

List-post: <mailto:tor-relays@lists.torproject.org>

List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=subscribe>

List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=unsubscribe>

References: <2201117.GUh0CODmnK@t520> <10743372.nUPlyArG6x@w530> <svuhCiJ2WY85XkXdRhdsYnjEZ3T8RnjmwdTwImkb75RASYVbf8t-UEXLBDiTeMxHGJkyQR6DRsy1mw-0U8wFVCP2NP0BIU12DulBsqXh7-c=@proton.me> <2033009.atdPhlSkOF@t520>

Reply-to: tor-relays@xxxxxxxxxxxxxxxxxxxx

Sender: "tor-relays" <tor-relays-bounces@xxxxxxxxxxxxxxxxxxxx>

P.S:

If this is a client to guard detection only, then why does my exit node also block a significant amount of DoS (I had around the same statistics when my guard probability fraction was still zero, so clearly something is working):

Aug 09 21:08:36 matrix tor[XXX]: Aug 09 21:08:36.000 [notice] Heartbeat: DoS mitigation since startup: 6 circuits killed with too many cells, 865308797 circuits rejected, 691 marked addresses, 0 marked addresses for max queue, 0 same address concurrent connections rejected, 0 connections rejected, 0 single hop clients refused, 0 INTRODUCE2 rejected.

Thank you,

George

On Friday, August 9th, 2024 at 8:59 PM, boldsuck lists@xxxxxxxxxxxxxxx wrote:

On Mittwoch, 7. August 2024 14:30:27 CEST George Hartley via tor-relays wrote:

This is already impossible, as both circuit and concurrent connection DoS
both gets detected and the IP in question flagged and blacklisted.

No.
DoS has been a topic of conversation at nearly all relay meetings for over 2
years. Enkidu and Toralf have developed Tor-ddos IPtables rules for the
community. Article10 specifically for Tor exits and trinity has developed the
patch.

https://gitlab.torproject.org/tpo/core/tor/-/issues/40676
Roger, Mike, Nick and Perry certainly wouldn't have let Trinity develop the
feature if the current DoS mitigations in Tor had helped.

Please see the manual on this:

https://2019.www.torproject.org/docs/tor-manual.html.en#DoSCircuitCreationEn
abled

This is a client to relay detection only. "auto" means use the consensus
parameter. (Default: auto)
It is defined in the consensus:
https://consensus-health.torproject.org/#consensusparams

Example: 500K connections from IP 1.2.3.4

These are numbers from reality and not fantasy.
AFAIK, Article10 and relayon already had 1,000,000 connections per IP!

--
╰_╯ Ciao Marco!

Debian GNU/Linux

It's free software and it gives you freedom!_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

Attachment: signature.asc
Description: OpenPGP digital signature

_______________________________________________ tor-relays mailing list tor-relays@xxxxxxxxxxxxxxxxxxxx https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays