Greetings operators! Today, we released tor 0.4.9.15 which contains three new DoS defenses aimed at mitigating the BEGIN_DIR thunderstorm attack we've all been experiencing. Quick data point (or refresher): BEGIN_DIR is a cell type that tor uses to send directory documents requests (ex: fetch consensus) over a circuit. Here are the details of the defenses and what to expect on the MetricsPort. 1. BEGIN_DIR rate limit per circuit: default On Exactly like the stream DoS defense (DoSStreamCreationRate), we put in a rate limit for BEGIN_DIR which applies to relays and bridges. With it, 4 new torrc options that are also consensus parameters: DoSBeginDirRateEnabled (default 1), DoSBeginDirRate (default 10) DoSBeginDirBurst (default 60) DoSBeginDirDefenseType (1 = no defense, 2 = refuse the stream, 3 = close the circuit; default 3). You DO NOT need to set these, please leave the consensus set those at the moment. MetricsPort new counter which is also present in the DoS heartbeat log line: tor_relay_dos_total{type="begindir_rate_rejected"} 2. One BEGIN_DIR per circuit from relays: default Off. A circuit that arrives from another relay, meaning its previous hop authenticated as a relay, may carry only one BEGIN_DIR over its whole lifetime. This behavior is solely controlled by the consensus with DoSBeginDirLimitEnabled as it shouldn't be flipped on individual relays as it can possibly lead to network degradation. We need most of the network to upgrade before we can turn this on. MetricsPort new counter which is also present in the DoS heartbeat log line: tor_relay_dos_total{type="begindir_rejected"} 3. One HSDir request per circuit: Always On. An HSDir now accepts at most one onion service descriptor fetch or upload per circuit. A second HS descriptor request on the same circuit closes the circuit. MetricsPort new counter which is also present in the DoS heartbeat log line: tor_relay_dos_total{type="begindir_hsdir_rejected"} We expect these defenses to mitigate the vast majority of BEGIN_DIR requests that we are seeing from this attack. However, this won't magically make the hundreds of circuits per second we see on a single relay disappear. You will still experience an heavy load as long as the attacker is doing their thing... There is also a big change to how directory authorities assign the HSDir flag, it is now sticky, meaning it survives a relay restart. A relay still needs 96 hours of uptime to get the HSDir flag the first time but once it has the flag and stays in the consensus, it keeps it. If your relay drops out of the consensus, the uptime requirement applies again. All other HSDir requirements (Stable, Fast, Running, DirCache 1) still apply as before. At this moment, we have a majority of authorities already upgraded to 0.4.9.15. One last important point. If you added "DirCache 0" to your torrc during this DoS attack, please remove it and see if things improve for your relay. The main issue with disabling DirCache is that you're effectively opting out of serving as a Fallbackdir, Guard, HSDir, and a directory cache. The network really needs these nodes so we'd strongly encourage you to revert that option. These are significant changes so we'd appreciate everyone's help in letting us know if you notice anything wrong or behaving unexpectedly. You can do so by writing on this list or via our Gitlab at https://gitlab.torproject.org. None of this work would have been possible without the help of several relay operators who generously gave their time and knowledge. We can't thank you enough for your help and to everyone running relays!!! Cheers! David -- MCgfKt8Z71zgn/ZfkxQViFHsfNFGHjprU2EQX+0o9HQ=