<div dir="ltr"><div>same here,</div><div><br></div><div>my 4 relays (guards) all had this log entry, with one of them the log entries are spread over a quarter of an hour (2 tor instances runnnig on this one):</div><div>(this one is on Central European time zone, CET)</div><div><br></div><div>Nov 2 05:15:22 : Possible compression bomb; abandoning stream.<br>Nov 2 05:15:23 : message repeated 2 times: [ Possible compression bomb; abandoning stream.]<br>Nov 2 05:16:21 : Possible zlib bomb; abandoning stream.<br>Nov 2 05:16:21 : Possible compression bomb; abandoning stream.<br>Nov 2 05:17:21 : Possible zlib bomb; abandoning stream.<br>Nov 2 05:17:21 : Possible compression bomb; abandoning stream.<br>Nov 2 05:19:21 : message repeated 5 times: [ Possible compression bomb; abandoning stream.]<br>Nov 2 05:19:21 : Possible zlib bomb; abandoning stream.<br>Nov 2 05:19:21 : Possible zlib bomb; abandoning stream.<br>Nov 2 05:20:21 : Possible compression bomb; abandoning stream.<br>Nov 2 05:22:21 : message repeated 4 times: [ Possible compression bomb; abandoning stream.]<br>Nov 2 05:22:21 : Possible zlib bomb; abandoning stream.<br>Nov 2 05:22:21 : Possible compression bomb; abandoning stream.<br>Nov 2 05:23:21 : Possible zlib bomb; abandoning stream.<br>Nov 2 05:23:21 : Possible compression bomb; abandoning stream.<br>Nov 2 05:23:21 : Possible compression bomb; abandoning stream.<br>Nov 2 05:24:21 : Possible zlib bomb; abandoning stream.<br>Nov 2 05:24:21 : Possible compression bomb; abandoning stream.<br>Nov 2 05:24:21 : Possible compression bomb; abandoning stream.<br>Nov 2 05:25:21 : Possible compression bomb; abandoning stream.<br>Nov 2 05:26:21 : message repeated 3 times: [ Possible compression bomb; abandoning stream.]<br>Nov 2 05:26:21 : Possible zlib bomb; abandoning stream.<br>Nov 2 05:26:23 : Possible compression bomb; abandoning stream.<br>Nov 2 05:27:21 : Possible compression bomb; abandoning stream.<br>Nov 2 05:29:39 : Possible compression bomb; abandoning stream.<br>Nov 2 05:29:44 : message repeated 3 times: [ Possible compression bomb; abandoning stream.]</div><div><br></div><div><br></div><div><br></div><div><br></div><div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">gr. Paul<br></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Nov 2, 2020 at 9:28 PM Chris Dagdigian <<a href="mailto:dag@sonsorol.org">dag@sonsorol.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>Same on my US exit relay:<br>
<br>
<span style="font-family:monospace">Nov 02 04:03:50.000 [warn]
Possible zlib bomb; abandoning stream.</span><span style="font-family:monospace"><br>
</span><span style="font-family:monospace">Nov 02 04:03:50.000 [warn]
Possible zlib bomb; abandoning stream.</span><br>
<br>
<br>
<br>
<span>
</span><br>
<blockquote type="cite" style="border:0px none">
<div style="margin:30px 25px 10px"><div style="width:100%;border-top:2px solid rgba(146,154,163,0.7);padding-top:10px"> <div style="display:inline-block;white-space:nowrap;vertical-align:middle;width:49%">
<a style="color:rgb(72,86,100);padding-right:6px;font-weight:500;text-decoration:none" href="mailto:christoph@links-nett.ch" target="_blank">Christoph Graf</a></div> <div style="display:inline-block;white-space:nowrap;vertical-align:middle;width:48%;text-align:right"> <font color="#909AA4"><span style="padding-left:6px">November
2, 2020 at 11:59 AM</span></font></div> </div></div>
<div style="color:rgb(144,154,164);margin-left:24px;margin-right:24px">
<p>Same here on my bridge:</p>
<p>Nov 2 06:21:04 raspipfupf Tor[2556]: Possible zlib bomb;
abandoning stream.<br>
Nov 2 06:21:04 raspipfupf Tor[2556]: Possible zlib bomb;
abandoning stream.</p>
<p>Time is UTC+1, nothing before and after</p>
<p>Cheers, Christoph<br>
</p>
<div>On 02.11.20 11:05, Guinness wrote:<br>
</div>
<br><fieldset></fieldset><br><div>_______________________________________________<br>tor-relays
mailing list<br><a href="mailto:tor-relays@lists.torproject.org" target="_blank">tor-relays@lists.torproject.org</a><br><a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays" target="_blank">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays</a><br></div>
</div>
<div style="margin:30px 25px 10px"><div style="width:100%;border-top:2px solid rgba(146,154,163,0.7);padding-top:10px"> <div style="display:inline-block;white-space:nowrap;vertical-align:middle;width:49%">
<a style="color:rgb(72,86,100);padding-right:6px;font-weight:500;text-decoration:none" href="mailto:guinness@crans.org" target="_blank">Guinness</a></div>
<div style="display:inline-block;white-space:nowrap;vertical-align:middle;width:48%;text-align:right"> <font color="#909AA4"><span style="padding-left:6px">November
2, 2020 at 5:05 AM</span></font></div> </div></div>
<div style="color:rgb(144,154,164);margin-left:24px;margin-right:24px"><div>Hi all,<br><br>We
are at least 3 users running middle relays from 0.4.4.5 and after
having<br>some logs like those :<br>```<br>Nov 02 05:30:55.000 [warn]
Possible compression bomb; abandoning stream.<br>Nov 02 05:30:55.000
[warn] Possible zlib bomb; abandoning stream.<br>Nov 02 05:30:56.000
[warn] Possible compression bomb; abandoning stream.<br>Nov 02
05:31:00.000 [warn] Possible compression bomb; abandoning stream.<br>Nov
02 05:31:00.000 [warn] Possible compression bomb; abandoning stream.<br>Nov
02 05:31:00.000 [warn] Possible compression bomb; abandoning stream.<br>Nov
02 05:31:55.000 [warn] Possible compression bomb; abandoning stream.<br>Nov
02 05:31:56.000 [warn] Possible compression bomb; abandoning stream.<br>```<br><br>I'm
wondering if this is an attack or a new feature (haven't checked<br>yet)
but I'd like to know how many users are impacted.<br><br>The
interesting informations are :<br> * Number of warnings<br> * What kind
of relay it is (middle, exit, entry)<br><br>After your answers, I'll
complete the issue I have opened on the bug<br>tracker.<br><br><br>Cheers,<br></div><br><fieldset></fieldset><br><div>_______________________________________________<br>tor-relays
mailing list<br><a href="mailto:tor-relays@lists.torproject.org" target="_blank">tor-relays@lists.torproject.org</a><br><a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays" target="_blank">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays</a><br></div>
</div>
</blockquote>
<br>
</div>
_______________________________________________<br>
tor-relays mailing list<br>
<a href="mailto:tor-relays@lists.torproject.org" target="_blank">tor-relays@lists.torproject.org</a><br>
<a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays" rel="noreferrer" target="_blank">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays</a><br>
</blockquote></div>