[tor-bugs] #7912 [Tor]: Cells that don't get inserted into cell queues can clog connection flushing

[Tor Bug Tracker & Wiki]

#7912: Cells that don't get inserted into cell queues can clog connection flushing
------------------------------------+---------------------------------------
 Reporter:  asn                     |          Owner:                    
     Type:  defect                  |         Status:  needs_review      
 Priority:  normal                  |      Milestone:  Tor: 0.2.4.x-final
Component:  Tor                     |        Version:                    
 Keywords:  tor-relay 023-backport  |         Parent:                    
   Points:                          |   Actualpoints:                    
------------------------------------+---------------------------------------

Comment(by cypherpunks):

 > Hm. A linear search over 32K of cells does seem pretty excessive at
 first glance.  I ran a quick test, to see how slow a linear search over
 65535 cells would be (yes, I made sure the cells were fragmented in
 memory).  On my laptop, it took 4.6 msec per worst-case search.  Compare
 that to 2.4 msec per old-style onion handshake, and we're feeling some
 pain there.

 Number of destroy cells in the queue or output buffer doesn't limited by
 number available circuit IDs. It depends of read bw, write bw, number of
 clients, number of circuits and method they used to fill space with
 destroy cells. Enough evil attacker could OOM even in same extremely edge
 case with it. I could be wrong with it however.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/7912#comment:10>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online