-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 After looking through the code a little, would a mitigation like this work? It just re-uses the existing DoSStreamCreation defense. I haven't tested it at all, but it looks like it should work. Would it be allowed for me to test this patch on the live network on my relays? All it does is move the code that handles BEGIN_DIR commands below the DoS rate-limiter so torrc's DoSStreamCreationEnable will throttle them. diff -Npura a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c --- a/src/core/or/connection_edge.c 2026-10-12 23:32:06.855730637 +0000 +++ b/src/core/or/connection_edge.c 2026-10-12 23:32:06.855730637 +0000 @@ -4324,19 +4324,10 @@ connection_exit_begin_conn(const relay_m n_stream->on_circuit = circ; if (msg->command == RELAY_COMMAND_BEGIN_DIR) { - tor_addr_t tmp_addr; - tor_assert(or_circ); - if (or_circ->p_chan && - channel_get_addr_if_possible(or_circ->p_chan, &tmp_addr)) { - tor_addr_copy(&n_stream->base_.addr, &tmp_addr); - } - return connection_exit_connect_dir(n_stream); + log_debug(LD_EXIT,"about to start the dns_resolve()."); } - log_debug(LD_EXIT,"about to start the dns_resolve()."); - - // in the future we may want to have a similar defense for BEGIN_DIR and - // BEGIN sent to OS. + /* limit BEGIN, BEGIN_DIR, and RESOLVE stream creation per circuit. */ dos_defense_type = dos_stream_new_begin_or_resolve_cell(or_circ); switch (dos_defense_type) { case DOS_STREAM_DEFENSE_NONE: @@ -4353,6 +4344,16 @@ connection_exit_begin_conn(const relay_m return -END_CIRC_REASON_RESOURCELIMIT; } + if (msg->command == RELAY_COMMAND_BEGIN_DIR) { + tor_addr_t tmp_addr; + tor_assert(or_circ); + if (or_circ->p_chan && + channel_get_addr_if_possible(or_circ->p_chan, &tmp_addr)) { + tor_addr_copy(&n_stream->base_.addr, &tmp_addr); + } + return connection_exit_connect_dir(n_stream); + } + /* send it off to the gethostbyname farm */ switch (dns_resolve(n_stream)) { case 1: /* resolve worked; now n_stream is attached to circ. */ Regards, forest -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQQtr8ZXhq/o01Qf/pow+TRLM+X4xgUCas1wGgAKCRAw+TRLM+X4 xoVYAQCNuo927s2AAIaZ7MLLbdDq6fmQjZIUfz0lHJ/dNT4a3wD+NuDBw51r2XlQ kZPKsroCemN4WgM35Mo8DPYQjCXCLQA= =E2LN -----END PGP SIGNATURE-----