From cac612af42798bc76d8933837a9da97ddc039c9b Mon Sep 17 00:00:00 2001 From: David Goulet Date: Tue, 17 Aug 2021 12:43:58 -0400 Subject: dir: Do not flag non-running failing HSDir When a directory request fails, we flag the relay as non Running so we don't use it anymore. This can be problematic with onion services because there are cases where a tor instance could have a lot of services, ephemeral ones, and keeps failing to upload descriptors, let say due to a bad network, and thus flag a lot of nodes as non Running which then in turn can not be used for circuit building. This commit makes it that we never flag nodes as non Running on a onion service directory request (upload or fetch) failure as to keep the hashring intact and not affect other parts of tor. Fortunately, the onion service hashring is _not_ selected by looking at the Running flag but since we do a 3-hop circuit to the HSDir, other services on the same instance can influence each other by removing nodes from the consensus for path selection. This was made apparent with a small network that ran out of nodes to used due to rapid succession of onion services uploading and failing. See #40434 for details. Fixes #40434 Signed-off-by: David Goulet --- changes/ticket40434 | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 changes/ticket40434 (limited to 'changes') diff --git a/changes/ticket40434 b/changes/ticket40434 new file mode 100644 index 0000000000..988bb416be --- /dev/null +++ b/changes/ticket40434 @@ -0,0 +1,6 @@ + o Minor bugfix (onion service): + - Do not flag an HSDir as non-running in case the descriptor upload or + fetch fails. An onion service closes pending directory connections + before uploading a new descriptor which can thus lead to wrongly + flagging many relays and thus affecting circuit building path selection. + Fixes bug 40434; bugfix on 0.2.0.13-alpha. -- cgit v1.2.3-54-g00ecf