[tor-bugs] #24687 [- Select a component]: Tor eats all mbufs on FreeBSD

[Tor Bug Tracker & Wiki]

#24687: Tor eats all mbufs on FreeBSD
--------------------------------------+--------------------------
     Reporter:  AMDmi3                |      Owner:  (none)
         Type:  defect                |     Status:  new
     Priority:  High                  |  Milestone:
    Component:  - Select a component  |    Version:  Tor: 0.3.1.9
     Severity:  Major                 |   Keywords:
Actual Points:                        |  Parent ID:
       Points:                        |   Reviewer:
      Sponsor:                        |
--------------------------------------+--------------------------
 I'm running tor relay on FreeBSD 11.1, and not long ago the system started
 to occasionally stop responding to the network with

 kernel: [zone: mbuf_cluster] kern.ipc.nmbclusters limit reached

 accompanied with

 kernel: sonewconn: pcb 0xfffff80003c61570: Listen queue overflow: 193
 already in queue awaiting acceptance (211 occurrences)

 messages in the logs.

 It first happened on Dec 13 and repeated 3 times, the approximate lifetime
 of the relay is ~1 day.

 Seems like a DOS attack which makes tor open a lot of connections and eat
 all the mbuf space. I don't see any peaks on trafic or pps graphs though,
 and there are no messages in tor log.

 I'm currently trying to gather more information.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/24687>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online