Opened 3 years ago

Last modified 12 months ago

#25609 new defect

Investigate Tor client retry behavior on failing onions

Reported by: asn Owned by:
Priority: Medium Milestone: Tor: unspecified
Component: Core Tor/Tor Version:
Severity: Normal Keywords: guard-discovery, 034-triage-20180328, 034-removed-20180328
Cc: gk, mcs, brade Actual Points:
Parent ID: Points: 2
Reviewer: Sponsor: Sponsor27-can


An attacker can cause a Tor client to create many circuits by continuously serving a broken/failing onion over and over again.

We should investigate how many circuits a Tor client is willing to setup for an onion with a non-existent descriptor, or an onion that is unwilling to rendezvous, and see if this is a security issue.

Child Tickets

Change History (6)

comment:1 Changed 3 years ago by asn

Some furhter input from arma:

18:25 <@armadev> i mean, the old behavior was:
18:26 <@armadev> fetch the onion descriptor, try each of the intro points, if they're all down, fetch a new version of the descriptor in case it changed, if it didn't 
                 change, fail.
18:26 <@armadev> and i guess on further attempts, either "keep failing" for a while, or "fetch a new descriptor, oh it's the same as the one we already have that 
                 failed, ok fail"
18:26 <@armadev> is the new behavior different?
18:52 <@armadev> i guess it's also related to the weird behavior where if you have five socks streams for the onion, you'll have five descriptor fetches or something

comment:2 Changed 3 years ago by asn

Keywords: TorBrowserTeam201803 removed

comment:3 Changed 3 years ago by nickm

Keywords: 034-triage-20180328 added

comment:4 Changed 3 years ago by nickm

Keywords: 034-removed-20180328 added

Per our triage process, these tickets are pending removal from 0.3.4.

comment:5 Changed 3 years ago by nickm

Milestone: Tor: 0.3.4.x-finalTor: unspecified

These tickets, tagged with 034-removed-*, are no longer in-scope for 0.3.4. We can reconsider any of them, if time permits.

comment:6 Changed 12 months ago by dgoulet

Parent ID: #20212
Sponsor: Sponsor27-can

Unparenting so we can move this ticket to a new parent related to s27 network team activities. For now, I'm putting it in -can so we can assess this once the -must are done.

Main related issue: #20212

Note: See TracTickets for help on using tickets.