[tor-relays] Tor can exceed your AccountingMax in 0.4.0+

[Roger Dingledine]

Hello wonderful relay operators,

I wanted to let you know about a bug that might affect you if you use
the AccountingMax option, in Tor 0.4.0 and later. Here's the ChangeLog
entry from the upcoming 0.4.2.3-alpha:

  o Major bugfixes (relay):
    - Relays now respect their AccountingMax bandwidth again. When relays
      entered "soft" hibernation (which typically starts when we've hit
      90% of our AccountingMax), we had stopped checking whether we should
      enter hard hibernation. Soft hibernation refuses new connections and
      new circuits, but the existing circuits can continue, meaning that
      relays could have exceeded their configured AccountingMax. Fixes
      bug 32108; bugfix on 0.4.0.1-alpha.

That is, when your relay enters "soft" hibernation, you stop accepting new
connections and new circuits (good), but you stop checking whether you've
hit the hard limit and need to close down the remaining circuits (bad).

The bug has the additional impact that when your Tor has entered soft
hibernation, it stops updating the 'state' file in its DataDirectory,
which means it doesn't record new bytes spent in the interval after
that point.

You can read more details on the trac ticket:
https://bugs.torproject.org/32108

We'll have an 0.4.2.3-alpha release out soon with what we hope is a fix.
And if it looks good then we'll plan to put out new 0.4.0.6 and 0.4.1.7
stables.

In the meantime, if this bug affects you, you might do some combination
of the following:

* Watch your relay's bandwidth use and logs more carefully than usual

* Downgrade to Tor 0.3.5.8 until the newer stables are ready

* Set your RelayBandwidthRate to a lower value so you don't hit soft
hibernation as quickly during this interval

* Apply the two-line patch yourself (and let us know whether anything
breaks)

Sorry for the troubles,
--Roger