[tor-relays] Re: Shutting down my ~40 guards

[forest via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 2026-10-15 16:45, Tor at 1AEO via tor-relays wrote:
> Two main defenses we've found successful across ~800 guard relays the
> last 5 months of the various attacks:
> 
> 1) Over provision CPU and RAM
> Few cores available per relay and enough RAM to let a few relays spike
> from 16-30GB (max we've seen is 90GB for one relay).
> 
> 2) Use mimallc to return the freed RAM faster than glibc, avoiding OOM
> more often
> Swap can help temporarily until mimallc frees the RAM

I'm sure that works for large dedicated servers, but there's not much
that can be done when you have 62 VPSes and a Raspberry Pi with 1-2 GB
each spread across the globe. All my servers are resource constrained,
although I do use jemalloc2 (but not mimalloc) to reduce memory use.

In my situation, memory use isn't even the limiting factor. My relays
rarely OOM before the provider suspends them for bandwidth overuse.

The full solution is to expand on these:

https://gitlab.torproject.org/tpo/core/tor/-/work_items/40589
https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/756

It's a security issue related to TROVE-2022-003, which had a fix that
was incomplete and did not mitigate a related vulnerability. A proper
fix _should_ stop the attacker dead in their tracks or at last vastly
increase their resource requirements.

> Few blogs with more details from the beginning of the June and July
> attacks, which are still ongoing: https://1aeo.com/blog

The circuit-building attack is under control on my relays, since I'm
protecting from it on the firewall-level using a ruleset inspired by
toralf's iptables generator. Unfortunately, the BEGIN_DIR flood cannot
be mitigated using that method since each connection contains multiple
multiplexed circuits, each of which can multiplex multiple streams.

Thank you very much for your work on documenting present and past DoS
attacks against the Tor network, btw! Your insight is invaluable.

Regards,
forest
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQQtr8ZXhq/o01Qf/pow+TRLM+X4xgUCatFLXwAKCRAw+TRLM+X4
xqgdAP4gB/a41kd35xX1Kg8TRq2j4LLiwGGCBNGwpWqzbLFKLwD8CWnW9C8NRAED
Xi1zUAHBoAWtR8wS8pu0DasRMV7a0QM=
=aTX/
-----END PGP SIGNATURE-----
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx