[tor-relays] Re: Shutting down my ~40 guards

[forest via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

After looking through the code a little, would a mitigation like this
work? It just re-uses the existing DoSStreamCreation defense. I haven't
tested it at all, but it looks like it should work. Would it be allowed
for me to test this patch on the live network on my relays?

All it does is move the code that handles BEGIN_DIR commands below the
DoS rate-limiter so torrc's DoSStreamCreationEnable will throttle them.

  diff -Npura a/src/core/or/connection_edge.c
b/src/core/or/connection_edge.c
  --- a/src/core/or/connection_edge.c     2026-10-12 23:32:06.855730637
+0000
  +++ b/src/core/or/connection_edge.c     2026-10-12 23:32:06.855730637
+0000
  @@ -4324,19 +4324,10 @@ connection_exit_begin_conn(const relay_m
     n_stream->on_circuit = circ;

     if (msg->command == RELAY_COMMAND_BEGIN_DIR) {
  -    tor_addr_t tmp_addr;
  -    tor_assert(or_circ);
  -    if (or_circ->p_chan &&
  -        channel_get_addr_if_possible(or_circ->p_chan, &tmp_addr)) {
  -      tor_addr_copy(&n_stream->base_.addr, &tmp_addr);
  -    }
  -    return connection_exit_connect_dir(n_stream);
  +    log_debug(LD_EXIT,"about to start the dns_resolve().");
     }

  -  log_debug(LD_EXIT,"about to start the dns_resolve().");
  -
  -  // in the future we may want to have a similar defense for
BEGIN_DIR and
  -  // BEGIN sent to OS.
  +  /* limit BEGIN, BEGIN_DIR, and RESOLVE stream creation per circuit.
*/
     dos_defense_type = dos_stream_new_begin_or_resolve_cell(or_circ);
     switch (dos_defense_type) {
       case DOS_STREAM_DEFENSE_NONE:
  @@ -4353,6 +4344,16 @@ connection_exit_begin_conn(const relay_m
         return -END_CIRC_REASON_RESOURCELIMIT;
     }

  +  if (msg->command == RELAY_COMMAND_BEGIN_DIR) {
  +    tor_addr_t tmp_addr;
  +    tor_assert(or_circ);
  +    if (or_circ->p_chan &&
  +        channel_get_addr_if_possible(or_circ->p_chan, &tmp_addr)) {
  +      tor_addr_copy(&n_stream->base_.addr, &tmp_addr);
  +    }
  +    return connection_exit_connect_dir(n_stream);
  +  }
  +
     /* send it off to the gethostbyname farm */
     switch (dns_resolve(n_stream)) {
       case 1: /* resolve worked; now n_stream is attached to circ. */

Regards,
forest
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQQtr8ZXhq/o01Qf/pow+TRLM+X4xgUCas1wGgAKCRAw+TRLM+X4
xoVYAQCNuo927s2AAIaZ7MLLbdDq6fmQjZIUfz0lHJ/dNT4a3wD+NuDBw51r2XlQ
kZPKsroCemN4WgM35Mo8DPYQjCXCLQA=
=E2LN
-----END PGP SIGNATURE-----
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx