Opened 4 years ago

Last modified 21 months ago

#15516 new enhancement

Consider dropping INTRODUCE2 cells when under load

Reported by: special Owned by:
Priority: Medium Milestone: Tor: unspecified
Component: Core Tor/Tor Version:
Severity: Normal Keywords: SponsorU-deferred, tor-dos, tor-hs
Cc: yawning Actual Points:
Parent ID: Points: medium
Reviewer: Sponsor: SponsorV-can

Description

In #15463, we're seeing an effective denial of service against a HS with a flood of introductions. The service falls apart trying to build rendezvous circuits, resulting in 100% CPU usage, many failed circuits, and impact on the guard.

We should consider dropping INTRODUCE2 cells when the HS is under too much load to build rendezvous circuits successfully. It's much better if the HS response in this situation is predictable, instead of hammering at the guard until something falls down.

One option is to add a HSMaxConnectionRate(?) option defining the number of INTRODUCE2 we would accept per 10(?) minutes, maybe with some bursting behavior. It's unclear what a useful default value would be.

We could try to use a heuristic based on when rend circuits start failing, but it's not obvious to me how that would work.

Child Tickets

Change History (20)

comment:1 Changed 4 years ago by asn

Cc: sjmurdoch yawning added

We should probably queue INTRODUCE2 cells, and act on them the best we can. If the queue grows too big (we are under DoS), we should drop cells enough so that we (and our guard) can handle the load.

This seems like queuing theory stuff, and specifically active queue management. Yawning suggested looking into algorithms like Stochastic Fair Blue and CoDeL .

comment:2 Changed 4 years ago by arma

I'd actually like to some exploration of initial throttling or dropping or queueing at the intro point as well. That was originally meant to be the first line of defense here.

(In a related design, the hs might consider which intro points the intro2 cells are arriving from, and if they're all arriving from one intro point, take that into account.)

comment:3 Changed 4 years ago by nickm

Milestone: Tor: 0.2.7.x-final
Priority: normalmajor

comment:4 Changed 4 years ago by dgoulet

Milestone: Tor: 0.2.7.x-finalTor: 0.2.8.x-final

comment:5 Changed 3 years ago by nickm

Sponsor: SponsorU

Assigning to SponsorU as a likely anti-dos measure. Could also be SponsorR

comment:6 Changed 3 years ago by nickm

Points: medium

comment:7 Changed 3 years ago by nickm

Milestone: Tor: 0.2.8.x-finalTor: 0.2.9.x-final

It is impossible that we will fix all 226 currently open 028 tickets before 028 releases. Time to move some out. This is my second pass through the "new" and tickets, looking for things to move to 0.2.9.

comment:8 Changed 3 years ago by isabela

Sponsor: SponsorUSponsorU-can

comment:9 Changed 3 years ago by nickm

Priority: HighMedium

comment:10 Changed 3 years ago by isabela

Milestone: Tor: 0.2.9.x-finalTor: 0.2.???

tickets market to be removed from milestone 029

comment:11 Changed 3 years ago by nickm

Parent ID: #15463#17293

comment:12 Changed 3 years ago by nickm

Keywords: SponsorU-deferred added
Sponsor: SponsorU-can

Remove the SponsorU status from these items, which we already decided to defer from 0.2.9. add the SponsorU-deferred tag instead in case we ever want to remember which ones these were.

comment:13 Changed 3 years ago by nickm

Keywords: tor-dos added

comment:14 Changed 3 years ago by nickm

Parent ID: #17293

Unparenting these from #17293; holding for future work.

comment:15 Changed 2 years ago by teor

Milestone: Tor: 0.2.???Tor: 0.3.???

Milestone renamed

comment:16 Changed 2 years ago by nickm

Keywords: tor-03-unspecified-201612 added
Milestone: Tor: 0.3.???Tor: unspecified

Finally admitting that 0.3.??? was a euphemism for Tor: unspecified all along.

comment:17 Changed 22 months ago by nickm

Keywords: tor-03-unspecified-201612 removed

Remove an old triaging keyword.

comment:18 Changed 22 months ago by nickm

Keywords: tor-hs added
Severity: Normal

comment:19 Changed 22 months ago by sjmurdoch

Cc: sjmurdoch removed

comment:20 Changed 21 months ago by nickm

Sponsor: SponsorV-can
Note: See TracTickets for help on using tickets.