Opened 8 months ago

Last modified 6 months ago

#24992 new defect

SingleOnion (and Tor2web?) connections may need better expiry, lots left open

Reported by: alecmuffett Owned by:
Priority: Medium Milestone: Tor: unspecified
Component: Core Tor/Tor Version: Tor: 0.3.2.9
Severity: Normal Keywords: single-onion, circuits, 034-triage-20180328, 034-removed-20180328
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

This is a followup to #24991, which has two of the config files (tor config, and tor log)

Expanding on the description in #24991, my blog has a low traffic single onion - barely gets hit over Tor at all - yet when I investigated it recently I found it claiming to have 6 circuits open for an extended period (~days) and also ~50 simultaneous TCP connections.

I confirmed this with netstat, and then by killing the Tor daemon which threw all the connections into simultaneous TIME_WAIT.

I mentioned this to Teor on IRC, who suggested that I log " a ticket about expiring single onion and tor2web connections, please" - because this seems really strange, and suggests that SingleOnions are not garbage-collecting properly.

Child Tickets

Attachments (1)

time-wait.txt (3.7 KB) - added by alecmuffett 8 months ago.
time-wait connection dump; all these relay connections were open.

Download all attachments as: .zip

Change History (7)

Changed 8 months ago by alecmuffett

Attachment: time-wait.txt added

time-wait connection dump; all these relay connections were open.

comment:1 Changed 8 months ago by alecmuffett

I'm setting up a dozen worker single-onions using the same config as this bug; two of them have complained at-startup, with the logs recording messages like this, which might be relevant to the large numbers of circuits being open.

Jan 24 13:17:35.000 [notice] Tor has successfully opened a circuit. Looks like client functionality is working.
Jan 24 13:17:35.000 [notice] Bootstrapped 100%: Done
Jan 24 13:19:49.000 [warn] Hidden service [scrubbed] exceeded launch limit with 10 intro points in the last 180 seconds. Intro circuit launches are limited to 10 per 300 seconds.
Jan 24 13:19:49.000 [warn] Service configured in "/home/pi/eotk/projects.d/x.d/hs-2.d":
Jan 24 13:19:49.000 [warn]   Intro point 0 at [scrubbed]: circuit is open
Jan 24 13:19:49.000 [warn]   Intro point 1 at [scrubbed]: circuit is open
Jan 24 13:19:49.000 [warn]   Intro point 2 at [scrubbed]: circuit is open
Jan 24 13:25:15.000 [warn] Hidden service [scrubbed] exceeded launch limit with 10 intro points in the last 205 seconds. Intro circuit launches are limited to 10 per 300 seconds. [121 similar message(s) suppressed in last 300 seconds]
Jan 24 13:25:15.000 [warn] Service configured in "/home/pi/eotk/projects.d/x.d/hs-2.d":
Jan 24 13:25:15.000 [warn]   Intro point 0 at [scrubbed]: circuit is open
Jan 24 13:25:15.000 [warn]   Intro point 1 at [scrubbed]: circuit is open
Jan 24 13:25:15.000 [warn]   Intro point 2 at [scrubbed]: circuit is open

comment:2 Changed 7 months ago by teor

Keywords: single-onion added; singleonion removed
Milestone: Tor: 0.3.4.x-final

comment:3 Changed 7 months ago by dgoulet

Considering 10 intro points (maximum for v2), a service is allowed to launch ((10 + 2) * 2) (see rend_max_intro_circs_per_period()) intro points in a 300 seconds window (5 min).

I expect that some of the intro points failed to establish properly (maybe due to the ongoing load on the network?) and then you hit the mark. Some INFO log would confirm that or help out greatly understand what is happening then?

For the ~50 TIME_WAIT ... with that amount it is due to network problems in some ways, most likely to the relays you are connecting to? That is the FIN or final ACK got lost and the connection was stucked there. I would be surprised that tor never close() those as at least the other side would have?

comment:4 Changed 6 months ago by nickm

Keywords: 034-triage-20180328 added

comment:5 Changed 6 months ago by nickm

Keywords: 034-removed-20180328 added

Per our triage process, these tickets are pending removal from 0.3.4.

comment:6 Changed 6 months ago by nickm

Milestone: Tor: 0.3.4.x-finalTor: unspecified

These tickets, tagged with 034-removed-*, are no longer in-scope for 0.3.4. We can reconsider any of them, if time permits.

Note: See TracTickets for help on using tickets.