[tor-relays] Log warning : possible (zlib) compression bomb on middle relays

[torix at protonmail.com]

Here, too.  Between 3 and 12 lines, all within 1-3 seconds. Not totally sure about my arithmetic between time zones, but all seem to be within 5 minutes. Bridge,middle, exits included.

--Torix


Sent with ProtonMail Secure Email.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Monday, November 2, 2020 10:05 AM, Guinness <guinness at crans.org> wrote:

> Hi all,
>
> We are at least 3 users running middle relays from 0.4.4.5 and after having
> some logs like those :
>
>     Nov 02 05:30:55.000 [warn] Possible compression bomb; abandoning stream.
>     Nov 02 05:30:55.000 [warn] Possible zlib bomb; abandoning stream.
>     Nov 02 05:30:56.000 [warn] Possible compression bomb; abandoning stream.
>     Nov 02 05:31:00.000 [warn] Possible compression bomb; abandoning stream.
>     Nov 02 05:31:00.000 [warn] Possible compression bomb; abandoning stream.
>     Nov 02 05:31:00.000 [warn] Possible compression bomb; abandoning stream.
>     Nov 02 05:31:55.000 [warn] Possible compression bomb; abandoning stream.
>     Nov 02 05:31:56.000 [warn] Possible compression bomb; abandoning stream.
>
>
> I'm wondering if this is an attack or a new feature (haven't checked
> yet) but I'd like to know how many users are impacted.
>
> The interesting informations are :
>
> -   Number of warnings
> -   What kind of relay it is (middle, exit, entry)
>
>     After your answers, I'll complete the issue I have opened on the bug
>     tracker.
>
>     Cheers,
>     --
>     Guinness
>
>
> tor-relays mailing list
> tor-relays at lists.torproject.org
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays